[Feature Request] Develop Reference IAM Architecture for RBAC / SSO

## Feature Description
Develop an extendable Role-Based Access Control (RBAC) model supporting third-party Identity Providers (IdP) via Single Sign-On (SSO).

## Use Case
Currently, IAM is handled without a standardized group-mapping structure. This feature is needed to cover 80% of standard customer use cases securely and consistently.

## Proposed Solution
Design and document a standard group-mapping structure linking Google Cloud Identity to external Identity Providers, integrating it into the `fast/stages-aw/0-bootstrap/` IAM deployment.

## Compliance & Deployment Context

Target Deployment Type(s):

* [ ] US Region Restricted (e.g., Access Policy constraint)
* [ ] FedRAMP Medium
* [x] FedRAMP High
* [ ] DoD IL4
* [ ] DoD IL5
* [ ] All / General

Relevant NIST 800-53r5 Controls:
* AC-2 (Account Management)
* AC-7 (Unsuccessful Logon Attempts).

## Reusability Check
Stellar Engine prioritizes reusability.

* [x] I have checked if this functionality can be achieved by extending an existing module or blueprint.
* [x] I have verified that this does not duplicate existing functionality.

## Alternatives Considered
Continuing to manually configure IAM bindings per deployment, which introduces human error and compliance risks.

## Additional Context
This addresses the "Reference IAM for RBAC" item from the legacy feature braindump from 2023.