Cover off/validate service account key rotation automation - if public/private key pairs are added

In response to a discussion on service account keys with Mohamed N. one of our CE's

Very good point - The non-default (appspot, compute, cloud build...) are at the moment hardcoded without keys during creation. We don't yet have private/public key pairs attached to the SA's via automation.
However we are targeting in the KCC version to switch to more dynamic SA firewall rule targets to start - so we will likely need to apply the key deletion/creation on the SA's and add tooling around the availability/downloading of the private key in the json file each time for other gcp services that need keys

see https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-security-controls.md#0150ac-6least-privilege