RELOPS-2531: add sgolub to 0DIN group

[markcor]

Adds Stephen Golub to zero_din_group, granting Contributor on the Mozilla 0DIN subscription (e1cb04e4-3788-471a-881f-385e66ad80ab) through the existing azurerm_role_assignment.zero_din_contributor attachment on the 0DIN group (3992d632-1c36-47e2-9d30-46bd9b4ebc01).

Group membership rather than a direct role assignment, consistent with how the rest of the team was provisioned in RELOPS-1921.

Plan / apply

Already applied — this PR records the change.

Plan: 1 to add, 0 to change, 0 to destroy.

  # azuread_group_member.zero_din_membership["sgolub@mozilla.com"] will be created
  + group_object_id  = "3992d632-1c36-47e2-9d30-46bd9b4ebc01"
  + member_object_id = "4691bf66-9cca-42f2-a8f0-3f03bf819df8"

No drift elsewhere in the stack. Re-running apply is a no-op (0 added, 0 changed, 0 destroyed), and the group now lists 8 members.

Reviewer note — identity governance

sgolub@mozilla.com did not exist in the tenant. Contrary to the ticket's description, there was no member, no guest, and no soft-deleted object matching "golub". It was created here as a cloud-only member account (4691bf66-9cca-42f2-a8f0-3f03bf819df8) at the requester's direction.

Two consequences worth a second opinion before merge:

• Mozilla IAM has no record of this identity, so nothing deprovisions it when Stephen leaves.
• If IAM later provisions the real sgolub@mozilla.com, it will collide with this object.

Note also that this repo otherwise never creates identities — 23 data "azuread_user" lookups, zero resource "azuread_user". A follow-up to have IAM adopt or replace the account is probably warranted.

Ticket: https://mozilla-hub.atlassian.net/browse/RELOPS-2531

🤖 Generated with Claude Code