Configure G4G w/ Model Armor for FedRAMP High

[jmpugh]

Description

This PR allows the customer to optionally configure G4G to use Model Armor, which enhances security and safety of AI applications by proactively screening the prompts and responses by the GE assistant and is supported on all GE editions at no additional cost.

Model Armor is authorized for FedRAMP High and FedRAMP Moderate deployments (see https://docs.cloud.google.com/docs/security/compliance/deploy-gemini-gov#authorized-services).

Fixes #140

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

I have tested prompts against GE apps with and without Model Armor and have confirmed that certain prompts that violate the default Model Armor configuration generate model responses in the unsecured app, while the secured app responds with the following:

Gemini Enterprise is unable to reply as the prompt violates your organization’s defined security policies.

[LanceWray]

LGTM

The base branch was changed.