Support Windows MDM secrets for GCP

[robbiet480]

Summary

This PR adds GCP Secret Manager support for the Windows MDM WSTEP identity certificate and key, enabling the GCP Terraform module to provision and expose these secrets to Fleet via Cloud Run's secret environment variable injection.

Changes

gcp/main.tf

• Creates two GCP Secret Manager secrets: fleet-mdm-wstep-identity-cert and fleet-mdm-wstep-identity-key
• Uses secret_data_wo (write-only) for secret versions to avoid storing sensitive values in Terraform state
• Injects the secrets into Fleet's Cloud Run service as FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES and FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES via extra_secret_env_vars

gcp/variables.tf

• Adds windows_mdm_wstep_identity_cert and windows_mdm_wstep_identity_key input variables (sensitive strings, PEM-encoded)

gcp/byo-project/iam.tf

• Consolidates the two separate google_secret_manager_secret_iam_member resources into a single for_each-based resource that iterates over all secrets in local.fleet_secrets_env_vars — this ensures the Fleet Cloud Run service account automatically gets Secret Accessor access to any secrets added via extra_secret_env_vars, including the new WSTEP secrets

.gitignore

• Adds .DS_Store, terraform.tfvars, *.key, and *.crt to prevent accidental commits of local state and key material

Usage

Provide the WSTEP cert and key via terraform.tfvars or a secrets manager pipeline:

windows_mdm_wstep_identity_cert = <<-EOT
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----
EOT

windows_mdm_wstep_identity_key = <<-EOT
  -----BEGIN PRIVATE KEY-----
  ...
  -----END PRIVATE KEY-----
EOT

These map directly to the FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES and FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES environment variables required by Fleet for Windows MDM enrollment.

---

PR description drafted with Claude (claude.ai/claude-code), reviewed by author.