Draft: Experimental Managed Instance Group provisioning path

Draft — prototype kept open as a fallback to !169 (merged).

Context: production-engineering#29053 (Option 2).

Adds --google-instance-group-manager (zonal) and --google-region-instance-group-manager + --google-region (regional) flags to the GCE driver. When set, the driver routes Create / Remove through the MIG's CreateInstances / DeleteInstances APIs instead of Instances.Insert / Instances.Delete. The MIG's instance template owns machine type, boot disk, network, image, labels, scheduling. Flags configuring those are logged as ignored rather than rejected.

Regional mode runs an extra step post-create: the CreateInstances response carries a region-scoped Operation whose TargetLink points at the MIG, not the new instance, so we ListManagedInstances by name, parse the zone from the instance's self-link, and write it back to Driver.Zone + Driver.ResolvedZone (libmachine persists those, so subsequent invocations target the right zone after state reload).

Why this is a fallback, not the path

!169 (merged) (Option 2b on #29053) achieves the same outcome via RegionInstances.BulkInsert with LocationPolicy + InstanceFlexibilityPolicy in the request body — no MIG resource to provision, no instance template to maintain, no target_size race between docker-machine and the MIG, ~1k LOC simpler. Same internal-fulfillment path. !169 (merged) is the preferred direction; this MR stays open as a fallback in case we hit a reason not to use bulkInsert.