CEL expression. Pass as a raw String -- the wrapper does not validate CEL syntax; invalid expressions surface as Cloud Armor apply-time errors.
final TfArg<String> expression;