feat(api-key): add custom_grants support for multi-NRN grants

[gdrojas]

Summary

The api_key module previously only supported a single NRN for all grants, which didn't reflect how nullplatform actually works — a single API key can have permissions across multiple accounts or resources at different NRN levels.

This PR introduces custom_grants to support that pattern, while keeping the existing custom_role_slugs + nrn flow intact for the simple case.

• Add custom_grants variable: explicit list of { nrn, role_slug } pairs
• Make nrn optional when custom_grants is used (NRN is defined per grant)
• Predefined types (agent, scope_notification, service_notification) still require nrn

Usage

Simple case (unchanged):

module "api_key" {
  source            = "nullplatform/api_key"
  type              = "custom"
  nrn               = "organization=123:account=456"
  custom_name       = "my-key"
  custom_role_slugs = ["developer"]
}

Multi-NRN grants:

module "api_key" {
  source      = "nullplatform/api_key"
  type        = "custom"
  custom_name = "my-key"
  custom_grants = [
    { nrn = "organization=123:account=111", role_slug = "developer" },
    { nrn = "organization=123:account=222", role_slug = "ops" },
  ]
}

Validations added

Condition	Error
type = "custom" without custom_name	custom_name is required
type = "custom" without roles or grants	custom_role_slugs or custom_grants must have at least 1 entry
Predefined type without nrn	nrn is required for predefined types
custom_grants + nrn set together	when using custom_grants, do not set nrn

Test plan

• Existing custom with custom_role_slugs + nrn — no changes, plan shows no diff
• custom_grants without nrn — API key created with grants per NRN
• All 4 preconditions triggered and validated

[sebastiancorrea81]

lgtm