feat(cloudsql-instance): allow overriding tier per read replica

[piotr-tokaj]

What

Adds an optional tier field to the per-replica object in var.replicas:

variable "replicas" {
  description = "Map of NAME=> {REGION, KMS_KEY, TIER} for additional read replicas. Tier defaults to the primary instance tier when unset. Set to null to disable replica creation."
  type = map(object({
    region              = string
    encryption_key_name = optional(string)
    tier                = optional(string)
  }))
  default  = {}
  nullable = false
}

and uses it on google_sql_database_instance.replicas:

tier = coalesce(each.value.tier, var.tier)

Why

Cloud SQL allows a read replica to have a different machine tier from its primary, and this is genuinely useful:

• Cost — analytics / reporting replicas often handle a fraction of the primary's QPS and can run on a much smaller tier.
• Validation — you can move a single replica to a bigger / smaller tier first to observe behaviour before resizing the primary.
• Regional sizing — a replica in a cheaper or more constrained region may need a different tier than the primary.

Today the module hardcodes every replica to var.tier, so the only workaround is to manage replicas outside the module.

Compatibility

• The new field is optional(string), so existing callers that pass replicas = { ... } without a tier key are unaffected: coalesce(null, var.tier) returns var.tier, which is exactly today's behaviour.
• The field lives on the per-replica object, so different replicas can have different tiers (or inherit).
• Does not touch the primary's tier handling.

Does not conflict with the sibling retain-backups change (#27) — that one touches var.tier-adjacent variables.tf only to add a separate variable and edits the settings {} block to wire it in; this PR's only main.tf change is the tier = coalesce(...) line, and its only variables.tf change is the replicas type/description.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Calvin-Cheng1]

LGTM