Automate tenant resource provisioning

[ferrarimarco]

This PR does the following:

• Provision a Cloud Source Repository to store cluster configuration.
• Use a service account and workload identity to authorize Config Sync to access the provisioned Cloud Source Repository.
• Automatically generate tenant configuration from the Kpt template package, according to the tenants that the blueprint user specified.
• Remove the fltenant1 package because we generate it dynamically.
• Update related comments and documentation.
• Fix an issue with setting firewall rules that were using destination_ranges instead of ranges. It worked because the resulting resource defaults to 0.0.0.0/0, but it causes diffs and potential issues after the first terraform apply.
• Use the right istio.io/rev label value to configure a managed ASM control plane.

Dependencies:

• feat: support configuring ACM git service account email terraform-google-modules/terraform-google-kubernetes-engine#1685