fix: grant all required roles to gitlab-ci-sa for terraform apply

Replace single container.admin binding with for_each over the full
set of roles needed to provision VPC, GKE, Artifact Registry,
Cloud SQL, service accounts, IAM bindings, APIs and VPC peering.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>