compute: don't flatten API-provided boot disk resource_policies into an unset field

[pose]

Picks up #16888, which was auto-closed for inactivity after its RECORDING run failed. Rebased onto current main, where flattenBootDisk works on raw map[string]interface{}, so the change is ported rather than replayed; the provider fix stays under @corymhall's authorship.

flattenBootDisk copies the boot disk's resource policies into boot_disk.initialize_params.resource_policies, reading them from a GET on the disk because the instance GET omits initializeParams. There, policies set inline at create time are indistinguishable from ones attached with google_compute_disk_resource_policy_attachment, so a disk with out of band policies populates a field the config never set, sometimes with more entries than its MaxItems: 1. The existing guard compared against nil, which a TypeList read never returns, so it never fired.

Abbreviated from TestComputeInstance_flattenBootDiskResourcePolicies:

// the boot disk carries two policies, both attached with
// google_compute_disk_resource_policy_attachment, none through initialize_params
d := testFlattenBootDiskConfigData(t, nil) // config leaves resource_policies unset
params := flattenBootDisk(d, attachedDisk, config)[0]["initialize_params"].([]map[string]interface{})

params[0]["resource_policies"]
// before: []interface{}{".../policy-a", ".../policy-b"}
//         two entries in a MaxItems: 1 list, in a field the config never set
// after:  nil, the attachment's policies stay out of initialize_params

The guard now uses GetOkExists + tpgresource.IsEmptyValue, so that a present-but-empty value counts as unset, and it moves into the branch where the disk lookup succeeded, which is the only place the disk's own fields are read.

An import read starts from an empty state, so the field is left unset there too: nothing says whether the disk's policies belong to initialize_params, and importing them can overflow the list. Sibling fields in the same flatten (snapshot, source_image_encryption_key, resource_manager_tags) are already empty on import. Step 6 of TestAccComputeInstance_diskResourcePolicies_attachmentDiff failed on exactly this in the RECORDING run and now ignores the attribute; the two earlier import steps still assert that attachment policies do not leak into the field.

Internal tests cover the create, refresh and import shapes of the read plus the disk-lookup error path. All four unset-field cases fail against the old guard.

Context: pulumi/pulumi-gcp#3666

compute: fixed `google_compute_instance` boot disk `initialize_params.resource_policies` being populated from the API when the field is not set in the config

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.