infra/gcp/lib: add ensure_only_services
infra/gcp/lib: add ensure_only_services

The goal is ensure that only services we have specified in k8s.io
source code are enabled.  This means disabling any service that either
wasn't directly specified, or isn't a direct dependency of services that
were directly specified.

This isn't perfect:
- it's bash+jq operating on a graph, what do you expect
- this does a single add/remove pass, it could be more are necessary
- this traverses service names alphabetically, not in dependency-order,
  so it uses --force when disabling services; this is scary, so unless
  we set an obnoxiously long env var, disable commands are just printed

NOTE: set K8S_INFRA_ENSURE_ONLY_SERVICES_WILL_FORCE_DISABLE=true to
actually disable services, may still require human attention

kubernetes/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io