Summary

• render GCE service-account project grants as google_project_iam_member
• align the Terraform target with the additive GCE API target
• avoid taking ownership of every principal assigned to the project role
• add a focused renderer regression and update GCE integration fixtures

This is stacked on #1 so the fork baseline integration fixtures are green first. The change is intentionally narrow and suitable for a later upstream PR.

Testing

• go test ./upup/pkg/fi/cloudup/gcetasks
• go test ./cmd/kops -run 'Test(MinimalGCEDNSNone|ManyAddonsGCE)$' -count=1\n- golangci-lint run ./upup/pkg/fi/cloudup/gcetasks\n- terraform fmt -check on both changed integration fixtures\n- make quick-ci\n\nThe repository-wide make verify-golangci-lint reports 34 pre-existing findings outside this change with the installed host linter; the changed package passes directly.