GCP Deployment Manager needs to delete IAM roles when DM is deleted

[jlewi]

Our deployment manager configs for GCP create service accounts and IAM roles.

When the deployment is deleted we delete the service accounts but the roles persist.

To fix this we may need to add actions to remove the roles but we need to execute it only on delete.

[jlewi]

I think we can deal with this by adding actions to remove the roles and setting runtimePolicy to DELETE.
https://github.com/GoogleCloudPlatform/deploymentmanager-samples/tree/master/examples/v2/cloudbuild