Docs: Bindings on the config connector service account must be moved from the GKE standard section into a GKE generic section as it is independent of whether we are running autopilot or standard - As a reference - try to use the automated script line 161 where don't have this issue - I'll add a link to the docs as well

Chris and I ran into this doc discrepancy during a manual client lz onboarding

Bindings on the config connector service account must be moved from the GKE standard section into a GKE generic section as it is independent of whether we are running autopilot or standard

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/docs/landing-zone-v2#gke-standard

As a reference - try to use the automated script line 161 where don't have this issue - I'll add a link to the docs as well
https://github.com/ssc-spc-ccoe-cei/gcp-tools/blob/main/scripts/bootstrap/setup-kcc.sh#L161

```
Set permissions for the "Yakima" (Google managed) service account. This account is autogenerated with the creation of the Config Controller instance.

export SA_EMAIL="$(kubectl get ConfigConnectorContext -n config-control \
-o jsonpath='{.items[0].spec.googleServiceAccount}' 2> /dev/null)"

gcloud organizations add-iam-policy-binding "${ORG_ID}" \
--member="serviceAccount:${SA_EMAIL}" \
--role=roles/resourcemanager.organizationAdmin \
--condition=None

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
--member "serviceAccount:${SA_EMAIL}" \
--role "roles/serviceusage.serviceUsageConsumer" \
--project "${PROJECT_ID}"
```