Document GCP permissions, managed tag, and deny policy

[mintlify]

Summary

Triggered by a follow-up backend change that hardens how Porter scopes its access to customer GCP projects. The change adds an opt-in IAM v2 deny policy that blocks the Porter service account from performing destructive operations on resources that do not carry the porter.run-managed=true Resource Manager tag, and binds that tag to every resource Porter provisions (GKE clusters, VPCs, KMS keys, Secret Manager secrets, GCS buckets, Artifact Registry repositories).

Changes

• Added security-and-compliance/gcp-permissions.mdx mirroring the existing AWS permissions page. Covers the bootstrap role, default predefined roles, the porter.run-managed resource tag, the optional porterManager custom role, and the optional deny policy (including the Workload Identity exception).
• Linked the new page from the GCP tab on the Connecting a cloud account page.
• Added the new page to the Security and Compliance section of the sidebar.

Notes

The custom role and deny policy are gated behind feature flags (gcp_custom_iam_role_enforcement and gcp_iam_deny_policy_enabled) and rolled out per project, so the doc frames them as opt-in features and points customers at Porter support to enable them.