Move remaining STRR services and jobs to Cloud SQL IAM auth

[Jacky-Pham]

what changed

this moves strr-email, strr-pay, and the eight database jobs to Cloud SQL automatic IAM auth using the shared Python Connector and pg8000 setup from bcgov/sbc-connect-common#77.

local development still uses the current password or socket settings when Cloud SQL runtime variables are not set.

• interactions-update now uses the shared helper so IAM wins even when old database variables are still present
• repeated helper tests were removed from the consumers and kept in Add 'max-width' for All Pages #77
• the deployment check now reads the active vault values and confirms every runtime service account matches its deploy project
• the workflow now runs when any covered vault or Cloud Deploy file changes
• Sonar exclusions are limited to the seven job config files because its duplication setting only works at the file level
• the strr-email sandbox instance now uses northamerica-northeast1
• all ten consumers use the same tested helper commit

relationship and dependency

this uses the same Python Connector and pg8000 setup as #1763.

this pr and #1763 do not change the same files, so they can merge in either order after #77 is merged and the pins are updated.

the branch is pinned to the tested #77 commit through my fork for now. #77 needs to merge first, then i will update all ten consumers to the bcgov merge commit and regenerate the locks before this merges.

before merge

merging to main starts the deploy, so these need to be done first:

• add DATABASE_IAM_USERNAME for queue services, DATABASE_JOB_IAM_USERNAME for jobs, DATABASE_INSTANCE_CONNECTION_NAME, and DATABASE_NAME in 1Password
• use bcrbk9-dev for dev, bcrbk9-test for test and uat, bcrbk9-tools for sandbox, and bcrbk9-prod for prod
• make sure each Cloud Run identity matches its database IAM username and has Cloud SQL client access and database login
• give sa-job write access to strr-db because it only has readonly access today and all eight jobs write to the database
• use full deploys or remove DATABASE_PASSWORD, DATABASE_URL, DATABASE_HOST, DATABASE_PORT, and DATABASE_UNIX_SOCKET because the redeploy path keeps old variables

testing

• full suites passed for all ten consumers
• latest interactions-update run: 36 passed, 90.91% coverage
• deployment checks: 3 passed
• shared connector: 21 passed, 3 credential tests skipped
• poetry lock checks, dependency installs, black, isort, actionlint, and diff check passed

[Jacky-Pham]

CI container builds could not fetch the companion commit from the upstream repository before bcgov/sbc-connect-common#77 merges, so the dependency is now pinned to the exact commit on my fork. Once the companion PR merges, I will switch the source URL back to bcgov before this PR is merged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud