Service account impersonation does not work with kmsp11

We planned on controlling access to our keys by giving access to a service account and having developers impersonate that service account to authenticate to KMS but kmsp11 does not recognize the credential json file format. The output is the same as if there was no credential file at all.

```
$ gcloud auth application-default login --impersonate-service-account $SERVICE_ACCOUNT
$ openssl req -new -x509 -days 90000 -config /opt/cert.conf -keyform engine -engine pkcs11 -key pkcs11:object=${KEY_NAME} -out /opt/${KEY_NAME}.x509.pem
engine "pkcs11" set.
kmsp11 failure occurred prior to library initialization: returning 0x30 from C_Initialize due to status INVALID_ARGUMENT: Invalid credentials. [type.googleapis.com/kmsp11.StatusDetails='CK_RV=0x30']
Unable to load module /opt/libkmsp11.so
Could not create log file: File exists
COULD NOT CREATE LOGFILE '20240813-090328.1200'!
kmsp11 failure occurred prior to library initialization: returning 0x30 from C_Initialize due to status INVALID_ARGUMENT: Invalid credentials. [type.googleapis.com/kmsp11.StatusDetails='CK_RV=0x30']
Unable to load module /opt/libkmsp11.so
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
140190594036160:error:82065030:PKCS#11 module:pkcs11_check_token:Device error:p11_load.c:88:
140190594036160:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:../crypto/engine/eng_pkey.c:78:
unable to load Private Key
```

The credential file looks like this

```json
{
"delegates": [],
"service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/abc@def.iam.gserviceaccount.com:generateAccessToken",
"source_credentials": {
"account": "",
"client_id": "XXXXXX.apps.googleusercontent.com",
"client_secret": "YYYYYYYY",
"refresh_token": "1//ZZZZZZZZ",
"type": "authorized_user",
"universe_domain": "googleapis.com"
},
"type": "impersonated_service_account"
}
```

We're falling back to a persistent service account key shared by all developers but it would be better if we can enforce authentication for each individual developer instead of having a shared key floating around.