Update code sample to use a sub-CA to issue leaf certificates

[gfxcc]

Description

Fixes # b/399335799

Note: If you are not associated with Google, open an issue for discussion before submitting a pull request.

Checklist

Readiness

• Yes, merge this PR after it is approved
• [] No, don't merge this PR after it is approved

Style

• My sample follows the rules described for Terraform in the Effective Samples style guide
• My sample follows the other requirements and best practices in the Contributing
  guide

Testing

• I have performed tests described in the Contributing guide:

  • Tests pass: terraform apply
  • Lint pass: terraform fmt check

Intended location

• Yes, this sample will be (or already is) included on cloud.google.com
  Location(s): https://cloud.google.com/certificate-authority-service/docs/using-terraform#tf-config-sample

• No, this sample won't be included on cloud.google.com
  Reason:

API enablement

• If the sample needs an API enabled to pass testing, I have added the service to the Test setup file

Review

• If this sample adds a new directory, I have added codeowners to the CODEOWNERS file

[glasnt]

/gcbrun

[glasnt]

/gcbrun