hashicorp#644 Add Support For BigQuery Access Control (hashicorp#1931)

* Updates based on PR comments

* Fix markdown nested list

* Second round of feedback

* Clarify pick one docs

Author: chrismorgan-hb

docs/r/bigquery_dataset.html.markdown

@@ -26,6 +26,15 @@ resource "google_bigquery_dataset" "default" {
   labels {
     env = "default"
   }
+
+  access {
+    role   = "READER"
+    domain = "example.com"
+  }
+  access {
+    role           = "WRITER"
+    group_by_email = "[email protected]"
+  }
 }
 ```
 
@@ -73,6 +82,43 @@ The following arguments are supported:
 
 * `labels` - (Optional) A mapping of labels to assign to the resource.
 
+* `access` - (Optional) An array of objects that define dataset access for
+    one or more entities. Structure is documented below.
+
+The `access` block supports the following fields (exactly one of `domain`,
+`group_by_email`, `special_group`, `user_by_email`, or `view` must be set,
+even though they are marked optional):
+* `role` - (Required unless `view` is set) Describes the rights granted to
+    the user specified by the other member of the access object. The following
+    string values are supported: `READER`, `WRITER`, `OWNER`.
+
+* `domain` - (Optional) A domain to grant access to.
+
+* `group_by_email` - (Optional) An email address of a Google Group to grant
+    access to.
+
+* `special_group` - (Optional) A special group to grant access to.
+  Possible values include:
+  * `projectOwners`: Owners of the enclosing project.
+  * `projectReaders`: Readers of the enclosing project.
+  * `projectWriters`: Writers of the enclosing project.
+  * `allAuthenticatedUsers`: All authenticated BigQuery users.
+
+* `user_by_email` - (Optional) An email address of a user to grant access to.
+
+* `view` - (Optional) A view from a different dataset to grant access to.
+    Queries executed against that view will have read access to tables in this
+    dataset. The role field is not required when this field is set. If that
+    view is updated by any user, access to the view needs to be granted again
+    via an update operation. Structure is documented below.
+
+The `access.view` block supports:
+* `dataset_id` - (Required) The ID of the dataset containing this table.
+
+* `project_id` - (Required) The ID of the project containing this table.
+
+* `table_id` - (Required) The ID of the table.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are