[DOC] - Document minimal GCP IAM permissions required for deploying and destroying Nebari

[marcelovilla]

Preliminary Checks

• This issue is not a question, feature request, RFC, or anything other than a bug report. Please post those things in GitHub Discussions: https://github.com/nebari-dev/nebari/discussions

Summary

Currently, our docs suggest to use a service account with four predefined roles attached. However, these are very broad permissions and they're far from ideal from a security and principle-of-least-privilege standpoint.

We should define and document custom GCP IAM roles with just enough permissions to deploy and destroy Nebari. This will help users follow best practices and safely integrate Nebari into more restrictive cloud environments.