[feature] Add exclude_services support

[mkrs2404]

Problem

cloudlist's per-provider config supports services: as a positive allowlist, but there's no way to express "enumerate everything except X".

To drop a single service from a provider's default set today, you have to manually list every other supported service. That's tedious and brittle — any time cloudlist adds a new service for that provider, every config that used the workaround needs updating to keep the new service enumerated.

cloudlist already has this pattern for other filter dimensions: exclude_account_ids for AWS and exclude_project_ids for GCP. Services are the only filter dimension where the exclude form is missing.

Solution

Add exclude_services as a first-class option that mirrors how services works today.

YAML:

- provider: gcp
  exclude_services:
    - cloud-function
  project_ids:
    - my-project

CLI:

cloudlist -p gcp --exclude-service cloud-function

Resolution semantics:

1. Start from services: if set (intersected with the provider's allowed set), otherwise default to all supported services for that provider.
2. Drop any entries listed in exclude_services.
3. Unknown values in either list are silently dropped (matching the existing services: behavior — typos shouldn't fail the whole run).

Backward compatible: the new field is additive, existing services: semantics unchanged.

[ehsandeep]

@mkrs2404 this was added in #746?

[mkrs2404]

@mkrs2404 this was added in #746?

That PR adds project id exclusions while this issue is about service exclusions