docs: clarify IAM binding authoritative scope is role + condition

[hsiam261]

Fixes hashicorp/terraform-provider-google#28785

The documentation for all _iam_binding resources describes them as "Authoritative for a given role," but the actual authoritative scope is the combination of role + condition (title + description + expression). This is misleading — users expect _iam_member to detect out-of-band additions, or expect _iam_binding to be authoritative across all conditions for a role, neither of which is true.

Changes to resource_iam.html.markdown.tmpl

1. _iam_binding description: "Authoritative for a given role" → "Authoritative for a given role and condition combination." Added note that out-of-band members will be detected as drift and removed.
2. _iam_member description: Clarified that out-of-band members will not be detected as drift.
3. Coexistence note: "same role" → "same role and condition combination."
4. role argument: "Only one binding per role" → "Only one binding per role and condition combination." Added note that multiple bindings for the same role are allowed with different conditions.
5. Warning block: Added sentence clarifying the authoritative scope is the unique (role, condition) combination.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@melinath, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 153f74f:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	137 files changed, 589 insertions(+), 589 deletions(-)
google-beta provider	View Diff	137 files changed, 589 insertions(+), 589 deletions(-)

[melinath]

I see why you're wanting to clarify this.

My main concern is that not all IAM resources support conditions, so including that broadly could be confusing in its own way. (That's why the documentation today splits the information about conditions into separate sections guarded by {{ if $.IamPolicy.IamConditionsRequestType }}.)

Could you try finding a way to only show the conditions information on IAM resources that support conditions?