fix(org-policies,docs): add essential contacts policy parameters and document blueprint deployer permissions

[aghassemlouei]

Description

This pull request addresses essential contacts org policy parameters and documents deployer permissions for database and serverless blueprints:

• Fixes [Bug] 0-bootstrap: default platform_policy.yaml enforces essentialcontacts.managed.allowedContactDomains with no parameters — essential contacts blocked org-wide out of the box (follow-up to #92) #108: Adds templated allowed domain parameters to essentialcontacts.managed.allowedContactDomains in 0-bootstrap/data/custom-org-policies/platform_policy.yaml so contacts on the verified organization domain are permitted out-of-the-box.
• Fixes [Documentation] postgresql and app-engine blueprints: add "Deployer Permissions" sections (IAM role set + impersonated-deploy provider configuration) #115: Adds "Deployer Permissions" sections to blueprints/il5/postgresql/README.md and blueprints/fedramp-high/app-engine/README.md documenting required IAM roles and explaining provider-level user_project_override / billing_project configuration for service account impersonation.

Fixes #108
Fixes #115

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: SI-5, IR-6, AC-6

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• Validated YAML syntax in platform_policy.yaml.
• Verified README markdown formatting and links in PostgreSQL and App Engine blueprints.

[Calvin-Cheng1]

LGTM