[zhewenfu-goog]

Adds psc_resource_target and dns_zone_target to gcp_config.access_config.network_configs of google_managed_kafka_cluster.

These fields control, per subnet, whether the Private Service Connect endpoints and the private DNS zone are created in the network's (Shared VPC host) project or in the cluster's (service) project. They map to the v1 API fields NetworkConfig.psc_resource_target / NetworkConfig.dns_zone_target, which reach GA with the Managed Service for Apache Kafka cross-project network controls launch (December 2026).

Modeling notes for reviewers

• type: String with the possible values listed in the description, per the repo's enum-vs-string guidance.
• default_from_api: true: for Shared VPC subnets the API normalizes an unset value to PSC_NETWORK_PROJECT / DNS_ZONE_NETWORK_PROJECT and returns it; for same-project subnets it echoes whatever was requested (empty if unset).
• Intentionally not immutable: true. The API enforces immutability per subnet (changing the value of an already-attached subnet fails with INVALID_ARGUMENT), while adding or removing subnets remains an in-place update. A ForceNew on a list element would instead plan a destroy/recreate of the cluster.
• New sample managedkafka_cluster_network_targets covers both fields in a test step. It uses a same-project subnet because the acceptance test project is not a Shared VPC service project; the API accepts and persists the values for same-project subnets as well.

Draft until the API fields are publicly available. The v1 API rollout exposing these fields is scheduled to complete in mid December 2026; acceptance tests / VCR recordings cannot pass before then. I will mark the PR ready for review once the rollout is complete.

Fixes b/569982665

Release Note Template for Downstream PRs (will be copied)

managedkafka: added `psc_resource_target` and `dns_zone_target` fields to `gcp_config.access_config.network_configs` in `google_managed_kafka_cluster`

[zhewenfu-goog]

Closing/reopening to re-trigger the pull_request_target workflows that hit startup_failure right after the fork was created.