Add GenerateSpec11Action and SafeBrowsing evaluation

This adds actual subdomain verification via the SafeBrowsing API to the Spec11
pipeline, as well as on-the-fly KMS decryption via the GenerateSpec11Action to
securely store our API key in source code.

Testing the interaction becomes difficult due to serialization requirements, and will be significantly expanded in the next cl. For now, it verifies basic end-to-end pipeline behavior.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=208092942

java/google/registry/config/RegistryConfig.java

@@ -531,6 +531,18 @@ public final class RegistryConfig {
       return beamBucketUrl + "/templates/spec11";
     }
 
+    /**
+     * Returns the default job zone to run Apache Beam (Cloud Dataflow) jobs in.
+     *
+     * @see google.registry.reporting.billing.GenerateInvoicesAction
+     * @see google.registry.reporting.spec11.GenerateSpec11ReportAction
+     */
+    @Provides
+    @Config("defaultJobZone")
+    public static String provideDefaultJobZone(RegistryConfigSettings config) {
+      return config.beam.defaultJobZone;
+    }
+
     /**
      * Returns the URL of the GCS location we store jar dependencies for beam pipelines.
      *

java/google/registry/config/RegistryConfigSettings.java

@@ -32,6 +32,7 @@ public class RegistryConfigSettings {
   public RegistrarConsole registrarConsole;
   public Monitoring monitoring;
   public Misc misc;
+  public Beam beam;
   public Kms kms;
   public RegistryTool registryTool;
 
@@ -96,6 +97,11 @@ public class RegistryConfigSettings {
     public String projectId;
   }
 
+  /** Configuration for Apache Beam (Cloud Dataflow). */
+  public static class Beam {
+    public String defaultJobZone;
+  }
+
   /** Configuration for Cloud DNS. */
   public static class CloudDns {
     public String rootUrl;

java/google/registry/config/files/default-config.yaml

@@ -246,6 +246,10 @@ misc:
   # hosts from being used on domains.
   asyncDeleteDelaySeconds: 90
 
+beam:
+  # The default zone to run Apache Beam (Cloud Dataflow) jobs in.
+  defaultJobZone: us-east1-c
+
 kms:
   # GCP project containing the KMS keyring. Should only be used for KMS in
   # order to keep a simple locked down IAM configuration.