docs(organization): document external IAM management for logging sinks at scale (#3746)

* docs(organization): document external IAM management for logging sinks at scale

* Update TOC

---------

Co-authored-by: Julio Castillo <jccb@google.com>

tests/modules/organization/examples/logging-iam-external.yaml

@@ -0,0 +1,47 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.log-bucket-0.google_logging_project_bucket_config.bucket[0]:
+    bucket_id: audit-0
+    location: global
+    project: project-id
+    retention_days: 30
+  module.log-bucket-1.google_logging_project_bucket_config.bucket[0]:
+    bucket_id: audit-1
+    location: global
+    project: project-id
+    retention_days: 30
+  module.org.google_logging_organization_sink.sink["audit-0"]:
+    filter: severity=NOTICE
+    include_children: true
+    name: audit-0
+    org_id: '1122334455'
+  module.org.google_logging_organization_sink.sink["audit-1"]:
+    filter: severity=WARNING
+    include_children: true
+    name: audit-1
+    org_id: '1122334455'
+  google_project_iam_member.log-bucket-writer:
+    project: project-id
+    role: roles/logging.bucketWriter
+    condition:
+    - title: log_bucket_writer
+
+counts:
+  google_logging_organization_sink: 2
+  google_logging_project_bucket_config: 2
+  google_project_iam_member: 1
+  modules: 3
+  resources: 5