Add DLP rules for Google / GCP credentials

[blitzcrieg1]

The DLP pack covers AWS, GitHub, Slack, bearer tokens, private keys, and SSN — but not Google. GCP keys are extremely common in agent workflows.

Task

Add rules to policies/dlp/manifest.yaml: a Google API key (AIza[0-9A-Za-z_-]{35}) and a GCP service-account marker. Category credentials, severity critical. No Python needed — follow the YAML shape of the existing github_pat rule.

Acceptance criteria

• A test in apps/orchestrator/tests/test_dlp_scanner.py proving the Google key matches and a benign string doesn't.
• Use a fake key and mark the line gitleaks:allow.
• pytest green.

Good first PR — regex only, no Python.