Read-only service accounts for automation and CI/CD

[ludoo]

WIP, design document in this PR has the rationale and explanation of changes.

This PR also

• adds a custom roles factory to the organization and project modules
• refactors the factory variables in organization, folder and project modules so they use our latest standard
• moves FAST stage 0 custom roles to YAML files passed to the organization module's factory
• removes the (now stale) custom_role_names variable from FAST stage 0
• refactors the FAST CI/CD workflows

Test errors will be expected until this has been completed.

[ludoo]

This is now ready, barring some IAM tweaks for the stage 2 and 3 CI/CD read-only service accounts, which I will test today. It can be reviewed, additional roles will be added before merging but won't change the PR structure.

[ludoo]

This is now ready for review. The second set of service accounts is still missing from multitenant stages, but I will add it once the approach has been validated. CI/CD tested with actual repositories for stages 0, 1, and 2 networking.

[juliocc]

lgtm 🧑‍🎄

Left a couple of small comments