add billing project id support to firewall endpoint resource

.changelog/10122.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+networksecurity: added required field `billing_project_id` to `google_network_security_firewall_endpoint` resource. Any configuration without `billing_project_id` specified will cause resource creation fail (beta)
+```

website/docs/r/network_security_firewall_endpoint.html.markdown

@@ -35,6 +35,12 @@ To get more information about FirewallEndpoint, see:
     * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
     * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
 
+~> **Warning:** If you are using User ADCs (Application Default Credentials) with this resource,
+you must specify a `billing_project` and set `user_project_override` to true
+in the provider configuration. Otherwise the ACM API will return a 403 error.
+Your account must have the `serviceusage.services.use` permission on the
+`billing_project` you defined.
+
 ## Example Usage - Network Security Firewall Endpoint Basic
 
 
@@ -56,6 +62,10 @@ resource "google_network_security_firewall_endpoint" "default" {
 The following arguments are supported:
 
 
+* `billing_project_id` -
+  (Required)
+  Project to bill on endpoint uptime usage.
+
 * `name` -
   (Required)
   The name of the firewall endpoint resource.