Remove org-level role/binding cleanup, improve lib_iam output

[spiffxp]

Part of umbrella issue to manage organization-level IAM assets (ref: #1659)

Followup to previous PRs:

• Manage organization roles #1726
• ensure-organization.sh followup #1737

See individual commit messages for details.

The first two commits are hopefully going to dramatically reduce output from IAM changes, such that unexpected additions or removals are more likely to stand out. A bunch of infra/gcp scripts could be updated to use lib_iam.sh instead of calling gcloud directly.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

/uncc @bartsmykla
/cc @ameukam @thockin

[ameukam]

/lgtm
/hold
In case thockin has something to say.

[spiffxp]

/hold cancel
If @thockin has time, can comment on this post-merge

[spiffxp]

Ensuring organization custom roles exist
  Ensuring organization custom role prow.viewer
  Ensuring organization custom role audit.viewer
  @@ -516,15 +516,27 @@ includedPermissions:
     - deploymentmanager.typeProviders.list
     - deploymentmanager.types.list
     - dialogflow.agents.list
  +  - dialogflow.answerrecords.list
  +  - dialogflow.callMatchers.list
     - dialogflow.contexts.list
  +  - dialogflow.conversationDatasets.list
  +  - dialogflow.conversationModels.list
  +  - dialogflow.conversationProfiles.list
  +  - dialogflow.conversations.list
     - dialogflow.documents.list
     - dialogflow.entityTypes.list
     - dialogflow.environments.list
     - dialogflow.flows.list
     - dialogflow.intents.list
     - dialogflow.knowledgeBases.list
  +  - dialogflow.messages.list
  +  - dialogflow.modelEvaluations.list
     - dialogflow.pages.list
  +  - dialogflow.participants.list
  +  - dialogflow.phoneNumberOrders.list
  +  - dialogflow.phoneNumbers.list
     - dialogflow.sessionEntityTypes.list
  +  - dialogflow.smartMessagingEntries.list
     - dialogflow.transitionRouteGroups.list
     - dialogflow.versions.list
     - dialogflow.webhooks.list
  Ensuring organization custom role secretmanager.secretLister
  Ensuring organization custom role organization.admin
  Ensuring organization custom role CustomRole
  Ensuring organization custom role iam.serviceAccountLister
Ensuring organization IAM bindings exist
Ensuring removed organization IAM bindings do not exist
  No bindings to remove
Ensuring removed organization custom roles do not exist
All done!

[spiffxp]

The above output is a bit sanitized, the first time I ran the script, it halted after updating audit.viewer

Opened #1801 to address