Verify that the google "VM Instances Least Privilege" check is correct

Version: 2.0.0

When running `./index.js --config=./config.js --compliance pci`, the `instanceLeastPrivilege` check produces this:

```
Category: Compute
Plugin: VM Instances Least Privilege
Description: Ensures that instances are not configured to use the default service account with full access to all cloud APIs
Resource: N/A
Region: us-central1
Status: FAIL
Message: The following service accounts have full access: gke-node-pool@REDACTED.iam.gserviceaccount.com

```
From the code, it seems like that's just checking if an instance is providing a scope to a service account, but that's only half of the equation. since it's required that an IAM role be added as well for the service account to get access.

From https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances :

> The combination of access scopes granted to the virtual machine instance and the IAM roles granted to the service account determines the amount of access a service account has for that instance. The service account can execute API methods only if they are allowed by both the access scope and the IAM role.

Is that check valid for GCP?

Start with ./index.js using --config=./config.js --compliance pci and trace the instanceLeastPrivilege check that produces the reported message. Compare its treatment of access scopes with the linked GCP guidance and determine whether IAM roles are also required; done means the check's validity and any needed correction are clearly established.

Written by the indexing model from the issue text.