Add support for Gitlab.com (SaaS)

[fjudith]

What does this PR do?

🛑 Please open an issue first to discuss any significant work and flesh out details/direction - we would hate for your time to be wasted.
Consult the CONTRIBUTING guide for submitting pull-requests.

• opa-platform: New GITLAB_PROVISIONING_ENABLED environnent variable to control the provisioning of the selft-hosted Gitlab instances.
• opa-platform: Add support of the provisioning of an IAM Identity Provider for Gitlab.com managed runner (a.k.a Gtilab SaaS runner) if self-hosted Gitlab instances provisioning disable (i.e. GITLAB_PROVISIONING_ENABLED=false)
• opa-common-construct: Allow Gitlab runner (self-hosted/managed) to assume the fine-grained provisioning role
• opa-platform: Renamed CREATE_ENV_PROVISIONING_ROLE to DANGEROUSLY_ENABLE_PROVISIONING_ROLE_WITH_ADMIN_ACCESS environnent variable, and add logic to provision the provisioning role with either fine-grained or full-access permissions.

Motivation

Current AWS Harmonix deployment requires dedicated self-hosted Gitlab server and runner provisioned by the opa-platform CDK app.
By default the provining role is provisioned with full-access permissions, we should provide a mechanism to switch to more least privilege allocation.

For Moderators

• Compile, build, tests successful before merge?

Additional Notes

Relates to issue: #119 #116