New attack technique: Encrypt GCS Objects Client-Side (gcp.impact.ransomware-gcs-client-side-encryption)

[Minosity-VR]

What does this PR do?

Adds a new GCP attack technique gcp.impact.ransomware-gcs-client-side-encryption that simulates a sophisticated ransomware attack by downloading GCS objects, encrypting them with AES-256-GCM client-side, re-uploading as .enc files, and deleting the originals.

Motivation

GCP parity effort with existing AWS techniques (analogous to aws.impact.s3-ransomware-client-side-encryption).

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

Test results

• Technique detonates successfully
• Detection log identified (storage.objects.create + storage.objects.delete) — there is no audit log emitted for GCS object operations without non-default Data Access audit log configuration; volume-based detection would likely yield too many false positives given typical GCS usage at scale