feat: allow specifying IAM bindings via iam_policy variable

Add a new variable, iam_policy, which allows one to map a set of IAM roles to assigned members. This has been ported from a MR for GitLab Project Factory, https://gitlab.developers.cam.ac.uk/uis/devops/infra/gitlab-project-factory/-/merge_requests/51

While we're here, make the project and region variables optional. It was a right pain in https://gitlab.developers.cam.ac.uk/uis/devops/infra/gitlab-project-factory/-/merge_requests/51 having to get a hold of them and teleport them in when the common case of "use what the Google provider specifies" can be easily added.

Closes #11 (closed)