docs(google-cloud): add Workload Identity Federation authentication

[MichaelTansiniSeqera]

Summary

• Adds a new Authentication methods section to the Google Cloud CE page (platform-cloud/docs/compute-envs/google-cloud.md) covering both service account keys and Workload Identity Federation
• WIF section is fully standalone — no need to cross-reference the Google Cloud Batch page
• Adds a security caution on the broad blast radius of roles/resourcemanager.projectIamAdmin and roles/iam.serviceAccountAdmin

Changes

New: Security caution in Service account permissions

Calls out that projectIamAdmin and serviceAccountAdmin are broad on shared projects, with an advanced hardening tip for scoping serviceAccountAdmin to towerforge-* via IAM conditions.

New: Authentication methods section

Service account keys — brief JSON key creation steps.

Workload Identity Federation — full standalone setup including:

1. Enable APIs — lists the five WIF-required APIs (cloudresourcemanager, iam, iamcredentials, logging, sts) plus a note on base APIs
2. Set up WIF in the GCP Console — 5 core steps (pool/provider, OIDC issuer, allowed audiences, attribute mapping, workloadIdentityUser binding with both wildcard and per-workspace forms) plus optional step 6 for Data Explorer (serviceAccountTokenCreator via gcloud)
3. Configure WIF credentials in Seqera — service account email, provider resource path, optional token audience; runtime troubleshooting caution

Sources

• Confluence: Google Cloud CE - Workload Identity Federation — primary source for Cloud CE-specific APIs, roles, and security notes
• Published docs: Google Cloud Batch — reference for WIF step structure, Data Explorer step, and credential fields

Verification

All items from the Confluence source checked against the draft:

• ✅ All Cloud CE-specific APIs documented
• ✅ All Cloud CE-specific IAM roles already present; security caution added
• ✅ SA-level WIF bindings (workloadIdentityUser, serviceAccountTokenCreator) documented
• ✅ Data Explorer optional step with exact gcloud command and error string
• ✅ Three credential fields in Seqera documented
• ✅ Runtime troubleshooting caution included

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	63c6222
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/6a5124cb8756d50007c0f571
😎 Deploy Preview	https://deploy-preview-1637--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[jonmarti]

LGTM!

You've covered all the Cloud-CE extras we identified, and the exact error phrase for signBlob is a nice touch for anyone Googling the failure. Two small things you might want to add, but neither is blocking:

• The security caution is spot-on for shared GCP projects, but for a dedicated project the risk is basically nil. Maybe soften it with a "on shared projects, …" opener so readers with a dedicated project don't over-worry?

• Could you link to the Data Explorer docs from the serviceAccountTokenCreator step? Would help anyone unfamiliar with where pre-signed URLs come into play.

[justinegeffen]

@MichaelTansiniSeqera, is this good to merge or are we waiting for a release?