Improve GKE service account posture by aligning with GKE best practices

[parulbajaj01]

Changes:

1. Create separate service accounts for workloads and node-pools in all GKE reference blueprints
2. Enable workload identity in all GKE reference blueprints

Submission Checklist

NOTE: Community submissions can take up to 2 weeks to be reviewed.

Please take the following actions before submitting this pull request.

• Fork your PR branch from the Toolkit "develop" branch (not main)
• Test all changes with pre-commit in a local branch #
• Confirm that "make tests" passes all tests
• Add or modify unit tests to cover code changes
• Ensure that unit test coverage remains above 80%
• Update all applicable documentation
• Follow Cluster Toolkit Contribution guidelines #

[annuay-google]

Can you also add details of testing done to verify this?

[annuay-google]

Please add the workload identity k8s service account to the cluster output. This improves discoverability

[parulbajaj01]

Details of testing done:

1. Ran the GKE A3 Ultra blueprint. Checked the service accounts created on both sides and their permissions
2. Followed the instructions present here to verify if we can write to GCS from the pod with the service account
3. Ran all the GKE integration tests

[annuay-google]

LGTM