Allow specifying cloudrun target without service name in net-lb-app-int module (#3771)

* Allow specifying cloudrun target without service name in net-lb-app-int neg_config

* add deprecation comment

modules/net-lb-app-int/main.tf

@@ -199,8 +199,10 @@ resource "google_compute_region_network_endpoint_group" "default" {
   description           = var.description
   network_endpoint_type = "SERVERLESS"
   cloud_run {
-    service  = try(each.value.target_service.name, null)
-    tag      = try(each.value.target_service.tag, null)
+    service = try(each.value.target_service.name, null)
+    tag = try(
+      coalesce(each.value.tag, try(each.value.target_service.tag, null)), null
+    )
     url_mask = each.value.target_urlmask
   }
 }

modules/net-lb-app-int/variables.tf

@@ -86,12 +86,14 @@ variable "neg_configs" {
     project_id  = optional(string)
     description = optional(string)
     cloudrun = optional(object({
-      region = string
+      region         = string
+      tag            = optional(string)
+      target_urlmask = optional(string)
       target_service = optional(object({
         name = string
-        tag  = optional(string)
+        # TODO: deprecate after one major release
+        tag = optional(string)
       }))
-      target_urlmask = optional(string)
     }))
     gce = optional(object({
       zone = string