fix(gemini-enterprise): resolve stage-0 teardown, internal VIP sharing, and access day bounds

[aghassemlouei]

Description

This pull request addresses three issues in blueprints/fedramp-high/gemini-enterprise/gemini-stage-0:

1. BigQuery Analytics Dataset Deletion (delete_contents_on_destroy):
   Sets delete_contents_on_destroy = true on google_bigquery_dataset.analytics_dataset in analytics.tf. Without this flag, terraform destroy fails whenever the Discovery Engine audit log sink has written date-partitioned tables to the dataset.
2. Internal Load Balancer Shared VIP (SHARED_LOADBALANCER_VIP):
   Sets purpose = var.deployment_type == "internal" ? "SHARED_LOADBALANCER_VIP" : null on google_compute_address.gemini_enterprise_ip in network.tf. This allows the port 80 HTTP redirect forwarding rule in stage-0 and the port 443 HTTPS forwarding rule in stage-1 to share the same internal IP address without conflicting.
3. Access Control Day Index Alignment (CEL getDayOfWeek()):
   Corrects access_start_day and access_end_day documentation across variables.tf, deploy.sh, README.md, and terraform.tfvars.sample to reflect the 0-indexed convention of CEL's getDayOfWeek() (0 = Sunday ... 6 = Saturday) rather than ISO-8601 (1..7). Adds Terraform validation blocks enforcing the 0..6 range.

Fixes #174
Fixes #185
Fixes #186

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: AC-2 (Account Management), AC-3 (Access Enforcement), SC-7 (Boundary Protection)

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• tofu fmt -check: Verified all modified Terraform files format cleanly with zero diffs.
• bash -n deploy.sh: Verified shell syntax passes without errors.
• terraform init -backend=false && terraform validate: Executed in blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/ confirming Success! The configuration is valid.