gcp: support projects with no default permissions (#3656)

* helm/gcp: use service account in operator and joinservice

* helm: format operator testdata

* terraform/iam: create additional service account for VMs

This service account is used in the following commits and is attached to the VMs

* config: pass VM service account from iam create to cluster create via config

* cli/iamcreate: limit name prefix length

* docs: add minimal gcp IAM permissions

terraform/infrastructure/gcp/variables.tf

@@ -76,6 +76,11 @@ variable "additional_labels" {
   description = "Additional labels that should be given to created recources."
 }
 
+variable "iam_service_account_vm" {
+  type        = string
+  default     = ""
+  description = "IAM service account used for the VMs"
+}
 variable "emergency_ssh" {
   type        = bool
   default     = false