Create random passwords only when needed, use write-only attribute for passwords

modules/cloudsql-instance/variables.tf

@@ -298,8 +298,10 @@ variable "time_zone" {
 variable "users" {
   description = "Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'."
   type = map(object({
-    password = optional(string)
-    type     = optional(string)
+    password         = optional(string)
+    password_version = optional(number)
+    type             = optional(string, "BUILT_IN")
   }))
-  default = null
+  default  = {}
+  nullable = false
 }