Make it possible to use this library with only roles/cloudkms.signerVerifier permissions

I'm trying to use `osslsigncode` to sign a binary. On a Debian system this invocation looks like:

```
osslsigncode sign -h sha256 \
-pkcs11engine /usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so \
-pkcs11module /usr/local/lib/libkmsp11.so \
-key "pkcs11:object=example-key" \
-certs test.crt -in test.bin -out test.signed.bin
```

I would expect that the `roles/cloudkms.signerVerifier` role would be sufficient here. However, it is not. https://cloud.google.com/kms/docs/reference/permissions-and-roles shows that `roles/cloudkms.signerVerifier` has the following IAM permissions:

* `cloudkms.cryptoKeyVersions.useToSign`
* `cloudkms.cryptoKeyVersions.useToVerify`
* `cloudkms.cryptoKeyVersions.viewPublicKey`
* `cloudkms.locations.get`
* `cloudkms.locations.list`
* `resourcemanager.projects.get`

As documented in https://github.com/GoogleCloudPlatform/kms-integrations/blob/6529ddfd020fa6655c153c0e66bed9176ab68e78/kmsp11/docs/user_guide.md#authentication-and-authorization, this library needs the IAM permissions `cloudkms.cryptoKeys.list` and `cloudkms.cryptoKeyVersions.list`.

https://github.com/GoogleCloudPlatform/kms-integrations/blob/6529ddfd020fa6655c153c0e66bed9176ab68e78/kmsp11/docs/user_guide.md#configuration says that at least 1 `key_ring` must be defined. It wasn't clear to me whether specifying `CKA_LABEL` or `CKA_ID` would skip the loading of the key ring.