Enforce GCP Resources Require at Least One Role

Fixes a bug where users could assign GCP resource users/groups with no role attached.