Support for Workload Identity Federation

[johnkeates]

Is your feature request related to a problem? Please describe.
Instead of using hardcoded secrets to access the Google APIs, Workload Identity Federation allows for AWS IAM-based short lived credentials

Describe the solution you'd like
Using Workload Identity Federation you can use a credential configuration for the Google SDK to configure the credential source to be something else, in this use case you would use an IAM Role for the lambda (or container or local binary) which provides it with short-lived AWS credentials. Those are in turn used to collect short-lived Google credentials for a service account to access the Google directory and admin APIs.

Additional context
This seems to be supported by the libraries that are already in use as per https://pkg.go.dev/golang.org/x/oauth2/google#hdr-Credentials and instead of directly calling the google.JWTConfigFromJSON function with the provided file-based credentials, the automatic credential discovery can be used. This is similar to the credential provider chain in the AWS SDK.

[kesor]

I achieved this, with a few tweaks to ssosync and a Lambda extension that generates a Google access key in a file, which is in turn used by #231

The full solution also includes #202 where our service account does not have a Domain-Wide Delegation to impersonate admins. Bur rather the service account has admin permissions to read users and groups, via a custom admin role in workspace. This also requires using the actual customer_id instead of my_workspace, which is hardcoded in the code.