Fix workload identity pool ID validation to strip the literal .svc.id.goog suffix

[nikolauspschuetz]

Bug

ValidateWorkloadIdentityPoolId (used by google_iam_workload_identity_pool) strips the optional .svc.id.goog suffix before its regex/length checks, but uses strings.TrimRight:

if strings.HasSuffix(value, defaultWorkloadIdentityPoolIdSuffix) {
    value = strings.TrimRight(value, defaultWorkloadIdentityPoolIdSuffix)
}

strings.TrimRight(s, cutset) treats its second argument as a set of characters ({'.','s','v','c','i','d','g','o'}), not a literal suffix. It greedily removes every trailing character in that set, not the 12-char .svc.id.goog suffix.

Concrete effects (base name = the ID before the suffix):

Input	after TrimRight	result today	correct
goods.svc.id.goog	""	rejected (regex + too short)	accepted (goods)
foods.svc.id.goog	"f"	rejected (too short)	accepted (foods)
33-char id + .svc.id.goog	trailing g also eaten	accepted	should be rejected (too long)

So valid pool IDs whose base name ends in any of s v c i d g o are wrongly rejected, and an over-length ID can slip through. The existing foo-bar.svc.id.goog test passes only by luck (foo-bar ends in r, outside the cutset), which is why this went unnoticed.

Fix

Use strings.TrimSuffix, which removes exactly the literal .svc.id.goog suffix (and is a no-op when absent, so the HasSuffix guard is no longer needed). No behavior change for valid inputs; the buggy rejections/acceptance are corrected.

Test

Added a case to TestValidateIAMBetaWorkloadIdentityPoolId: goods.svc.id.goog (a valid ID whose base name ends in a cutset character) is expected to pass. It fails under the old TrimRight code and passes with TrimSuffix; all existing cases still pass.

iam: fixed validation of `google_iam_workload_identity_pool` IDs ending in `.svc.id.goog` where the base name ends in one of the suffix's characters

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.