ci(gcp): secret scope guard does not check the role on secret-level Secret Manager grants #505

Found while reviewing #504.

scripts/check-gcp-secret-scope.sh (CI job "GCP Secret Manager grant scope") flags Secret Manager grants at project, folder and organization scope. It does not look at the role on a secret-level grant. During the #504 review a mutation changed google_secret_manager_secret_iam_member.admin_password_writer from roles/secretmanager.secretVersionAdder to roles/secretmanager.admin, and the guard still exited 0 (OK across 199 files).

So a secret-scoped over-grant, such as secretmanager.admin or secretmanager.secretAccessor where only a version-adder is needed, goes through unnoticed even though the check's purpose is least-privilege grants.

Possible fix: keep an allowlist of the roles expected on secret-level members (secretAccessor, secretVersionAdder) and fail on any other Secret Manager role in google_secret_manager_secret_iam_member / _binding, with a fixture in scripts/test-gcp-secret-scope.sh that fails before the change. Decide whether _policy resources need the same treatment.

Not a defect in #504, which grants exactly the roles the app needs (AccessSecretVersion and AddSecretVersion only, traced in internal/secrets/gcp_resolver.go).