Retention policies should be configured using bucket lock on log buckets

[brettcurtis]

Enabling retention policies on log buckets protects logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended that you set up retention policies and configure Bucket Lock on all storage buckets used as log sinks.

The _Default bucket isn't used, but let's see if we can lock it anyway. This bucket is created in every project. We'd need to import the bucket into the state before locking it.

[brettcurtis]

We can't do this in the child module yet: hashicorp/terraform#33474