Add VPC Service Controls evidence gates to gcp-review

[KooZuKi]

Summary

• add a VPC Service Controls evidence review step for enforced status vs dry-run spec
• add bridge, Shared VPC, ingress/egress, access-level, and Not Evaluable guidance
• add VPC-SC report fields, severity guidance, references, and changelog entry

Validation

• git diff --check
• local frontmatter required-field check
• local prompt-injection pattern scan

Bounty

Addresses #1169. Preferred payment details can be provided privately after acceptance.