appengine: add service_account to google_app_engine_application (#18718)

[jbbqqf]

Summary

Add the optional service_account argument to google_app_engine_application, surfacing the Application.serviceAccount field that the AppEngine Admin API has long supported. The field is the app-level default identity used by deployed App Engine versions when no per-version identity is supplied.

Fixes hashicorp/terraform-provider-google#18718 — see hashicorp/terraform-provider-google#18718

Why

Today users provisioning an AppEngine application via Terraform cannot pin a custom service account; the API only accepts it on Create (it is immutable post-creation), so the gap forces a gcloud app create --service-account= workaround that fights with subsequent terraform apply. Surfacing the field on the resource is the standard fix.

GCP API reference:

• https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps — Application.serviceAccount: "The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one."

What changed

This change is to a hand-written Terraform resource (Type=Handwritten in the meta yaml; source-of-truth lives at mmv1/third_party/terraform/services/appengine/resource_app_engine_application.go in magic-modules).

• New schema attribute: service_account — Optional, Computed, ForceNew (the API rejects updates to this field).
• Wired into the expandAppEngineApplication constructor and the resourceAppEngineApplicationRead flatten loop.
• Added to the meta yaml's fields: map (api_field: 'serviceAccount').
• Added to the registry docs page.

Edge cases tested

#	Scenario	HCL excerpt	Expected	Verified by
1	Default (field unset)	# service_account omitted	API picks the default GAE service account; terraform plan shows no diff after refresh	Computed: true lets the API-assigned default round-trip cleanly
2	Set to a custom SA on create	service_account = "my-app-sa@my-proj.iam.gserviceaccount.com"	API accepts; subsequent reads return the same value	manual flatten of app.ServiceAccount
3	Edge: attempt to change after create	service_account = "different-sa@..."	Plan shows forces replacement and the user gets a clear "must destroy + recreate" message	ForceNew: true (the AppEngine API does not list this field in Apps.Patch's supported updateMask)

A live before/after smoke against an AppEngine application was not run because:

• AppEngine application creation is permanent — the resource cannot be deleted in this provider (resourceAppEngineApplicationDelete only logs a warning), and even at the GCP API level it lives until project deletion.
• Burning a sandbox project per smoke iteration is wasteful when the gap is a clean schema addition that terraform validate proves on its own.

The static gap is provable directly: an HCL config with service_account = "..." returns Error: Unsupported argument on origin/main and validates cleanly on this branch.

Test protocol

Test	Result	Notes
go run ./mmv1 -product=appengine -version=ga	OK	mmv1 third_party file pulled through cleanly
go run ./mmv1 -product=appengine -version=beta	OK
go build ./google/services/appengine/... (TPG)	OK
go build ./google-beta/services/appengine/... (TPGB)	OK
go vet ./google/services/appengine/... (both)	OK	no new warnings

Related PRs

• magic-modules: https://github.com/jbbqqf/magic-modules/tree/feat/18718-appengine-service-account (source of truth — reviewer should land this one and let modular-magician downstream)
• terraform-provider-google: https://github.com/jbbqqf/terraform-provider-google/tree/feat/18718-appengine-service-account
• terraform-provider-google-beta: https://github.com/jbbqqf/terraform-provider-google-beta/tree/feat/18718-appengine-service-account

Disclosure

This PR was implemented with assistance from Claude Code as part of a focused contribution batch on hand-written AppEngine resources. The diff was reviewed manually against the GCP API documentation linked above.

The author (a human) reviewed the diff and the build/vet output before opening this PR.