Fix IAM bindings for logging sinks

- Move to non-authoritative bindings to allow multiple sinks to write to
  the same destination
- Allow automatically adding logging bucket IAM bindings

modules/folder/outputs.tf

@@ -51,7 +51,7 @@ output "firewall_policy_id" {
 }
 
 output "sink_writer_identities" {
-  description = ""
+  description = "Writer identities created for each sink."
   value = {
     for name, sink in google_logging_folder_sink.sink : name => sink.writer_identity
   }