Prototype/yaml SCED/SC2G HA partner interconnect - cloud to ground for profile 5 and 6

TODO
- Investigate hub spoke as part of partner interconnect enabled transitive peering solution (Around the 25 limit)
- Traffic Engineering across multiple interconnects through cloud router + BGP sessions - https://cloud.google.com/network-connectivity/docs/router/how-to/updating-priority
- adjust TEF V3 backport https://github.com/terraform-google-modules/terraform-example-foundation/issues/940
-

- 20230626 - Terraform version in https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/249
#78
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/dev/solutions/landing-zone/architecture.md#di-05-complete-network-design
-Need to spin up/verify an alternative to regular peering (due to the 25 limit/project) for the hub-spoke pattern https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview over the normal https://cloud.google.com/architecture/deploy-hub-spoke-vpc-network-topology

Status
20230512: shutdown Interconnect + VPN for costs - redeploy just HA-VPN between 2 orgs to simulate SC2G (we could do this with just peering but will run BGP via VPN + local DNS zones
- see slides 33-30 section C (Hub + NGFW) of the network patterns deck https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_3909
-
20230419: TODO for this week (Michael O) - fully automate the interconnect and HA VPN artifacts into kcc yaml and merge a PR
start with the 4 Config Connector sections off Compute https://cloud.google.com/config-connector/docs/reference/resource-docs/compute/computeexternalvpngateway

20230416: Interconnect + HA VPN (1 of 2) POC OK

https://gc-cloud-services.canada.ca/s/article/How-would-a-request-for-Secure-Cloud-to-Ground-SC2G-Connectivity-service-be-initiated-EN?language=en_US

Shared google networking design patterns slide deck 202301 (use gmail or gcp account to request access)
https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_820

R1:
Implement SCED/SC2G for GCP

R2:
Use MacSEC over IPSec

R3:
partner interconnect over direct connect

R4:
ASNs
Google: 16550

Phase 1: brute force minimal connection test
Phase 2: Architecture final review

Initial work item is to start an interconnect and get the SDN UID to tag traffic. Testing out https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#provisioning

## Links
Slide 19, 18 were used a lot in presentations at IRCC and ISED (from 2019 but still valid) - for profile 5/6
https://wiki.gccollab.ca/images/7/75/GC_Cloud_Connection_Patterns.pdf
review: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/tree/master/blueprints/networking/private-cloud-function-from-onprem
review https://cloud.google.com/network-connectivity/docs/interconnect/concepts/ha-vpn-interconnect

slide 65 in progress in
https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g2223ba5ee2b_0_665

20230413

20230321

https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/tree/master/blueprints/networking/psc-hybrid

## Organization Policies
- subset of https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/org-policies/organization
- add org policy admin role
- constraints/compute.disableGlobalSerialPortAccess
- constraints/compute.vmExternalIpAccess

# Architecture Notes
- Multiple Shared VPCs per Host Project - sharing interconnect/VPN https://cloud.google.com/architecture/best-practices-vpc-design#connecting_multiple_networks