Document Workspace add-on deployment takeover

[carlospolop]

Summary

• document the live-tested gsuiteaddons.deployments.update HTTP endpoint takeover boundary
• explain the conditional per-user Workspace OAuth-token impact without claiming an OAuth-consent or tenant-wide bypass
• add permission-denied enumeration fallbacks, detection, and hardening guidance
• correct the previous universal claim that Workspace groups are freely joinable

Validation

• exact-permission custom role: deployment GET/LIST returned 403, full replacement PUT returned 200
• project testIamPermissions returned only gsuiteaddons.deployments.update
• cross-organization development installation failed as documented
• all referenced official URLs return HTTP 200
• git diff --check passes

No production resources or user content were accessed; all disposable GCP/Workspace lab resources were removed.