Cloud Identity procedures for 3rd party email integration for the 3 options (Workspace, IdP identity federation or custom MX records) - fix: add email alias forwarding on the domain

See also #270
Requirements
- email integration with Cloud Identity to be able to send/receive emails to users with a secondary email
- For example: a billing quota request is sent out for a sub organization - one where all the accounts are Cloud Identity. In this case you can substitute the email for a backed account like another parent org that is using a workspace account to receive replies https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md#quota-increase
- Another example is alert triggers to a free cloud identity account - the emails need to reach a backing email system on a 3rd party provider like Workspace, AAD, Workmail

Workarounds
- select 1+ accounts on the org as workspace accounts and set the default user creation flag to free cloud identity for the rest. If you select workspace as your super admin account - there will be 100 free cloud identity accounts to use (up from the default 50)

Options
- add forwarding email alias from this org to external org - directly on the domain hosting the email system (dual enable workspace api for other emails if enabled)
- secondary email in admin (not an option for all use cases)
- Workspace account for 1 or more cloud identity accounts (in the organization in question or a parent org owning the workspace account)
- Full IdP Identity Federation to Microsoft AAD or AWS Workmail
- custom MX records on the subdomain zone
-

Discussion
for workspace we get 4 MX records on the domain - those match, for non-workspace the emails may match depending on whether the 3rd party AAD or AWS Workmail are on the same domain as the GCP org

Notes
- https://cloud.google.com/architecture/landing-zones/decide-how-to-onboard-identities#option_2_use_federation_with_an_external_identity_provider
- https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md

References
#225
#182