feat(accesscontextmanager): support in-place updates for IngressPolicy and EgressPolicy

[germancv2]

Description

Remove resource-level immutable: true from ServicePerimeterIngressPolicy and ServicePerimeterEgressPolicy to enable in-place updates via PATCH.

Problem

Both resources are marked immutable: true, which sets ForceNew: true on every field. Any change — even adding a single project to ingress_from.sources.resource — triggers a destroy + create cycle.

This is a non-atomic operation: the old policy is removed first, then the new one is added. During the gap, traffic matching that ingress/egress rule is denied.

Root cause

The Google REST API already supports in-place updates. Both Create and Delete internally use PATCH with updateMask=status.ingressPolicies on the parent perimeter. The same endpoint works for updates — but the Terraform resource never generates an Update function because immutable: true prevents it.

Fix

• Remove immutable: true at resource level
• Add update_verb: PATCH and update_url: "{{perimeter}}" → generates resourceXxxUpdate function
• Mark title as immutable: true at property level (it is an identity field used for matching)
• Remove the create_before_destroy note (no longer needed — updates are now in-place)

The existing PatchUpdateEncoder in nested_query.go.tmpl handles the update logic:

1. GET current perimeter state
2. Find matching policy by identity fields (ingressFrom, ingressTo, title)
3. Replace the policy in-place in the list
4. PATCH the perimeter with the updated list

Resources affected

• google_access_context_manager_service_perimeter_ingress_policy
• google_access_context_manager_service_perimeter_egress_policy

References

• REST API: https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/patch
• Related issue (performance): 5.X Performance Issues for resource_access_context_manager_service_perimeter hashicorp/terraform-provider-google#19474

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@melinath, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[yerbis09]

Closing to reopen from the correct account (CLA author mismatch).

[yerbis09]

Closed CLA confict, sorry!