Limited Permissions Service Account

**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

**Describe the solution you'd like**
Drawing on @bburky 's feedback to the above PR.
> Because the Google docs aren't too clear on this, it's probably worth adding a note to the README to point specifically to the "Assign a role to a service account" docs section and explain how to set up the service account:
> https://developers.google.com/workspace/guides/create-credentials#assign_a_role_to_a_service_account
>
> I would suggest to create a custom admin role limited to only user API read and directory API read. Grant the admin role to the service account with "Assign a role to a service account". The service account's maximum permissions are those of the Admin role (the service account will not be restricted to specific OAuth roles like with domain-wide delegation).
> The "Optional: Set up domain-wide delegation for a service account" steps can be skipped entirely. This method does not use domain-wide delegation at all or impersonation.

Additionally refer to:
- [Selective Service Account access](https://github.com/taers232c/GAMADV-XTD3/wiki/Authorization#selective-service-account-access)
- [About administrator roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en)

Start in the README and review the linked Google Workspace service-account documentation and selective-access references. Explain how to create a custom admin role with only user API and directory API read access, assign it to the service account, and clarify that domain-wide delegation and impersonation are not required. Done means the README points to the relevant setup guidance and describes the limited-permission configuration.

Written by the indexing model from the issue text.