Add workload identity federated login

[illusional]

No description provided.

[jmarshall]

LGTM, in that I'm satisfied that the relevant parts are equivalent to the already-working example in cpg-infrastructure-private.

I'm not qualified to vet the random number in the workload_identity_provider, and it's a bit curious that the tails of the two differ (…/github-pool/providers/github-provider versus …/gh-deploy-pool/providers/gh-provider).

[illusional]

Thanks @jmarshall, that's due to my being inconsistent (but close) in my naming when following the setup example here: https://github.com/google-github-actions/auth

[jmarshall]

Thanks. Basically this is one of the things about GCP that is utterly opaque to those of us who are not intimately working with it at an admin-ish level.