FeatureReq: Simpler optional gcloud LandingZone - combined perimeter + client-landing-zone for non-managed clients - 3 VPC (2 for fortigate cluster)

Normally we run the 4 packages core-lz, client-setup, client-lz, client-project-setup and then the hub-env package around the following architecture which stands up 1 VPC for the client and 4 for the hub-env
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Architecture

Client requires a non-managed landing zone consisting of a single VPC containing both the perimeter firewall and the client workloads.
This LZ is a one-off LZ per client - unmanaged

An alternative to peering the client-landing-zone host-project with this hub-env project in #847
However peering is unavoidable as the example fortigate deployment needs 2 min for the dual LB version.

proposed gcloud only
start with base fortinet script - except this one is 3 VPC with 2 for the fortigate cluster (internal LB is in its own subnet) + 1 for the workloads
https://github.com/fortinet/fortigate-tutorial-gcp/blob/main/gcloud/tutorial-create.sh
see
https://github.com/fortinet/fortigate-tutorial-gcp/issues/1
https://github.com/fortinet/fortigate-tutorial-gcp/issues/5

## Current hub-env VPCs are 4
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/solutions/project/hub-env/network/vpc.yaml#L15

check hardcoded management subnet
and docs
https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/gcp-administration-guide/736375/about-fortigate-vm-for-gcp