Use Workload Identity Federation in the start-tsp action

[skeet70]

The action authenticated gcloud with a service account JSON key passed in as the gcloud-auth input. It now impersonates depot-ci@ironcore-dev-1 through the github-actions WIF pool, the same way the docker workflow already does. The input is gone, so this is a breaking v2; callers need id-token: write on the job and pull-requests: write for the reaction steps.

Callers migrate by dropping the input and adding to the job:

permissions:
  contents: read
  id-token: write
  pull-requests: write

Consumer PRs for ironcore-alloy, cmk-s3-proxy, tenant-security-client-{go,java,nodejs} follow once the tag exists.

rust-ci-test.yaml's start_tsp job exercises the v2 action in this PR's CI.

[github-actions]

Merging this PR will move these workflow tags:

start-tsp-v2.0.0

[github-actions]

File	Coverage	Lines
All files	66%	66%	✅

Minimum allowed coverage is 24%

Generated by 🐒 cobertura-action against 1a4b8cb

[skeet70]

You can see it working in https://github.com/IronCoreLabs/workflows/actions/runs/33773732459/job/100710133981?pr=177, in the Start TSP -> Authenticate to GCP -> Run google-github-actions/auth@v3 step/drilldown.