fix(workload-identity): resolve inconsistent conditional result types in output

Fixes #1112

When use_existing_gcp_sa is unknown at plan time, Terraform fails with
'Inconsistent conditional result types' because data.google_service_account
and google_service_account.cluster_service_account have different object types.

The fix uses one(concat(...)) instead of a conditional expression:
- Only one list will ever have elements (based on count conditions)
- concat() avoids type comparison between the two different resource types
- one() extracts the single element from the concatenated list

This approach is type-safe and works regardless of when use_existing_gcp_sa
is known.

Author: ramanvasi

modules/workload-identity/output.tf

@@ -41,5 +41,10 @@ output "gcp_service_account_name" {
 
 output "gcp_service_account" {
   description = "GCP service account."
-  value       = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0] : google_service_account.cluster_service_account[0]
+  # Use one(concat(...)) instead of conditional to avoid type mismatch between
+  # data source and resource (one will always be empty based on count)
+  value = one(concat(
+    data.google_service_account.cluster_service_account,
+    google_service_account.cluster_service_account
+  ))
 }