Fix/56 bq delete protection

[Calvin-Cheng1]

Description

This pull request introduces a configurable force_destroy parameter, enhances resource protection and deletion safety, ensures configuration audit compliance, and optimizes the code layout across all FAST Assured Workloads stages (fast/stages-aw).

1. Configurable GCS Bucket Force-Destroy Parameter (force_destroy)
   Introduced a new configurable variable force_destroy (defaulting to false) to replace hardcoded values and allow users to toggle force deletion of managed GCS buckets across the workspace stages:
   * Added Variable Definition (force_destroy default false):
   • 0-bootstrap/variables.tf
   • 1-resman/variables.tf
   • 2-networking-a-fedramp/variables.tf
   • 2-networking-b-il5-ngfw/variables.tf
   • 3-security/variables.tf

• Applied Variable Reference (force_destroy = var.force_destroy) across 10 GCS bucket definitions:
  • 0-bootstrap/automation.tf (automation-tf-output-gcs, automation-tf-bootstrap-gcs, automation-tf-resman-gcs)
  • 0-bootstrap/log-export.tf (log-export-gcs)
  • 1-resman/branch-networking.tf (branch-network-gcs)
  • 1-resman/branch-security.tf (branch-security-gcs)
  • 1-resman/branch-tenants.tf (tenant-core-gcs, tenant-self-iac-gcs-outputs, tenant-self-iac-gcs-states)
  • 2-networking-b-il5-ngfw/ngfw.tf (ngfw-bootstrap-bucket)

2. Variable Alphabetization & Clean Code Refactoring

   • Re-arranged all variable declarations in alphabetical order inside:
   • 0-bootstrap/variables.tf
   • 1-resman/variables.tf
   • 2-networking-b-il5-ngfw/variables.tf

3. NGFW Bootstrap GCS Bucket Versioning
   Ensured GCS object versioning (versioning = true) on the ngfw-bootstrap-bucket in fast/stages-aw/2-networking-b-il5-ngfw/ngfw.tf is paired with safe deletion parameters

Fixes #56 (GitHub issue id)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • FedRAMP Moderate
  • DoD IL4
  • DoD IL5
  • [] General / All
• NIST 800-53r5 Controls: SI-12 (Information Management and Retention), SC-28 (Protection of Information at Rest), CP-9 (System Backup and Recovery)

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• terraform fmt: Executed on all modified stage files to ensure clean formatting with zero diffs.
• git status: Confirmed exactly 6 files modified matching our intentional changes.

[aghassemlouei]

What do you think about parameterizing it so that it's an easy toggle rather than having to flip a few switches?