Limited Permissions Service Account

[ChrisPates]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
Drawing on @bburky 's feedback to the above PR.

Because the Google docs aren't too clear on this, it's probably worth adding a note to the README to point specifically to the "Assign a role to a service account" docs section and explain how to set up the service account:
https://developers.google.com/workspace/guides/create-credentials#assign_a_role_to_a_service_account

I would suggest to create a custom admin role limited to only user API read and directory API read. Grant the admin role to the service account with "Assign a role to a service account". The service account's maximum permissions are those of the Admin role (the service account will not be restricted to specific OAuth roles like with domain-wide delegation).
The "Optional: Set up domain-wide delegation for a service account" steps can be skipped entirely. This method does not use domain-wide delegation at all or impersonation.

Additionally refer to:

• Selective Service Account access
• About administrator roles