Made cloud identity groups updatable and updated documentation

mmv1/products/cloudidentity/api.yaml

@@ -129,13 +129,16 @@ objects:
       - !ruby/object:Api::Type::KeyValuePairs
         name: 'labels'
         required: true
-        input: true
         description: |
-          The labels that apply to the Group.
+          One or more label entries that apply to the Group. Currently supported labels contain a key with an empty value.
+
+          Google Groups are the default type of group and have a label with a key of cloudidentity.googleapis.com/groups.discussion_forum and an empty value.
 
-          Must not contain more than one entry. Must contain the entry
-          'cloudidentity.googleapis.com/groups.discussion_forum': '' if the Group is a Google Group or
-          'system/groups/external': '' if the Group is an external-identity-mapped group.
+          Existing Google Groups can have an additional label with a key of cloudidentity.googleapis.com/groups.security and an empty value added to them. This is an immutable change and the security label cannot be removed once added.
+          
+          Dynamic groups have a label with a key of cloudidentity.googleapis.com/groups.dynamic.
+          
+          Identity-mapped groups for Cloud Search have a label with a key of system/groups/external and an empty value.
   - !ruby/object:Api::Resource
     name: 'GroupMembership'
     base_url: '{{group}}/memberships'

mmv1/third_party/terraform/tests/resource_cloud_identity_group_test.go

@@ -44,6 +44,7 @@ resource "google_cloud_identity_group" "cloud_identity_group_basic" {
 
   labels = {
     "cloudidentity.googleapis.com/groups.discussion_forum" = ""
+	"cloudidentity.googleapis.com/groups.security" = ""
   }
 }
 `, context)