new cloud security compliance service (#15651)

Author: shuyama1

.ci/infra/terraform/README.md

@@ -48,9 +48,10 @@ After applying this configuration:
 - Enroll in Cloud Armor Managed Protection Plus tier
 - Add Cloud Identity Premium Plan to the Google Workspace domain
 - Perform the Privileged Access Manager set-up https://pantheon.corp.google.com/iam-admin/pam/setup
-- (Org only) Enroll the org in the Premium tier of Security Control Center
 - Upload a model with the name `tf-static-1` to the Vertex AI model registry
   - This should only be necessary until uploading new models is supported in the provider.
+- (Org only) Enroll the org in the Premium tier of Security Control Center
+- (Org only) Enable Compliance Manager https://cloud.google.com/security-command-center/docs/compliance-manager-enable
 
 Quotas that will need to be adjusted to support all tests:
 - Project quota for the new service account

.ci/infra/terraform/main.tf

@@ -249,6 +249,7 @@ module "project-services" {
     "cloudquotas.googleapis.com",
     "cloudresourcemanager.googleapis.com",
     "cloudscheduler.googleapis.com",
+    "cloudsecuritycompliance.googleapis.com",
     "cloudtasks.googleapis.com",
     "cloudtrace.googleapis.com",
     "composer.googleapis.com",