New attack technique: Backdoor a Cloud Function (gcp.persistence.backdoor-cloud-function)

[Minosity-VR]

What does this PR do?

Adds a new GCP attack technique gcp.persistence.backdoor-cloud-function that grants unauthenticated invocation access to a Cloud Functions v2 function by adding an allUsers IAM binding on both the function and the underlying Cloud Run service.

Motivation

GCP parity effort with existing AWS techniques (analogous to aws.persistence.lambda-backdoor-function).

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

Test results

• Technique detonates successfully
• Detection log identified (google.cloud.functions.v2.CloudFunctionsService.SetIamPolicy and google.cloud.run.v2.Services.SetIamPolicy with allUsers binding) — note that organization-level policies can prevent public access while still generating the audit log