[Feature] Actor Identity

For Alpha, we need to give Actors access to OIDC JWTs and SPIFFE certificates issued by substrate. We already have the broker RPCs implemented, but we have the following open items:

* How do we expose the credentials into the Actor (filesystem mounts, metadata server, vsock)?
* Formalize the claims in each credential.
* Make atelet/ateom use the actor credentials for snapshot storage / retrieval.
* (For GCP) Prove out federation of the substrate IDP back to GCP, and demonstrate how it can be used against GCS.

## Basic design

The substrate control plane includes a broker API, where a caller can exchange a K8s-layer credential (service account JWT or service account certificate) for a substrate JWT / certificate.

The substrate credential will carry at least the following claims:
* Actor Template Namespace
* Actor Template Name
* Actor ID

These credentials will be federatable, and so should be able to be used against GCS, S3, and other cloud provider services. They could also be used for actor-to-actor authentication, and general actor-to-service authentication.

## (GCP-specific) Federation

Both OIDC JWTs and SPIFFE certificates can be federated into GCP IAM using Workload Identity Federation.

While it will not be scalable to create and delete per-actor IAM policies for each actor, it should be possible to use IAM conditions to write a single policy that authorizes every actor to access their own data. For example, "all callers from substrate issuer X have storage/object.admin on GCS bucket Y, as long as the object path starts with `actors/${ate.dev/actor-id}`".