Looks like key_protection_level input would already accept "EXTERNAL_VPC", it is just missing in "possible values" example string list. The new input field that we would need to implement is crypto_key_backend in order to make "EXTERNAL_VPC" key protection level type fully work.
TL;DR
google_kms_crypto_key resource supports 4 types of protection_level ("SOFTWARE", "HSM", "EXTERNAL", "EXTERNAL_VPC") while kms module key_protection_level lists only "SOFTWARE" and "HSM" as valid options.
Terraform Resources
Detailed design
Additional information
No response