Define root-level support for governance custom roles and landing-zone Secrets Manager ACLs #83

Feature gap

Some implemented module capabilities cannot be configured through the Accelerator root contract. A consumer using tfvars, including Landing Zone Configurator, cannot select them without editing Terraform code.

Verified on main at 2bb7c755692674ad619ffc46a0a17a781f019106:

1. Governance custom_roles exists, but the root governance call does not supply it and there is no corresponding root input. This is separate from the custom roles already supported per landing-zone project.
2. Landing-zone secretsmanager_acls feeds instance ACLs, but landing_zones and its non-regional/regional module calls do not expose/pass that option.

This is a root-interface enhancement, not a claim that every internal module parameter should become a public option.

Acceptance criteria

• Decide the public configuration contract for these two capabilities and document any intentional exclusion.
• Wire supported options through the relevant non-regional and eu01/eu02 module calls.
• Preserve current defaults for existing tfvars.
• Add tests proving that non-default input reaches the intended resources and unrelated resources are unchanged.
• Update root/module docs and examples.

Related: #69 concerns creating projects without an initial owner; exposing these options does not resolve that separate requirement. The Configurator capability catalogue must distinguish root-configurable options from module-internal parameters until this is settled.