Feature - Support GCP IAM Roles for Service Accounts

/kind feature

1. Describe IN DETAIL the feature/behavior/change you would like to see. GCP has support for IAM Roles using K8s service accounts, and I think it would be great if kOps could handle configuring this automatically. GKE Workload Identity docs.

kOps already supports AWS IAM Roles for service accounts docs. Example of kOps cluster spec stanza:

spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: s3://publicly-readable-store
    enableAWSOIDCProvider: true

Ideally, I would define a similar stanza for serviceAccountIssuerDiscovery but with GCP specific values

spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: gs://publicly-readable-store
    enableGCPOIDCProvider: true

I've also found gcp-workload-identity-federation-webhook which does the same things as amazon-eks-pod-identity-webhook. Maybe kOps can add that to addons as well.

FR for AWS IAM Role for Service accounts - https://github.com/kubernetes/kops/issues/8264

2. Feel free to provide a design supporting your feature request.