Least Privilege : Google Workspace Directory

**Is your feature request related to a problem? Please describe.**
Currently ssosync uses:
- a super admin user account
- impersonation (my_customer)
- credentials file

**Describe the solution you'd like**
Eliminate each of these, using:
- service account (down scope to least privilege and Read Only
- customer_id parameter
- Workload Identity federation - integrated with IAM

but because of the large install base, continue to support the historic authentication schema until v3.

The issue does not name files or tests. Start by tracing the existing authentication schema used by the CLI and AWS Lambda paths, then map how impersonation, credentials files, customer_id, service accounts, and Workload Identity Federation would coexist through v3. Done means least-privilege read-only authentication is supported while the historic schema continues to work.

Written by the indexing model from the issue text.