Keyless Google auth via Workload Identity Federation (no downloaded service-account key)

### Problem

`ssosync` authenticates to the Google Admin SDK only via a downloaded service-account key (`google.JWTConfigFromJSON`). That's a blocker in environments that prohibit SA keys:

- GCP org policy `iam.disableServiceAccountKeyCreation` (common in hardened orgs).
- Running ssosync outside GCP (e.g. an AWS Lambda), where the modern keyless approach is Workload Identity Federation rather than a static key.

There is currently no way to run ssosync without a long-lived key.

### Proposal

When no service-account key is provided, fall back to Application Default Credentials + service-account impersonation (`google.golang.org/api/impersonate`), carrying the Workspace admin as `Subject` so domain-wide delegation still applies. It activates only when a key is absent and `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` is set; the existing key path and the requested scopes are unchanged (fully backward compatible).

This lets ssosync run keyless — e.g. an AWS Lambda federated to GCP via WIF, impersonating the sync service account — with no long-lived credential.

We run this in production today, and I'm opening a PR alongside this issue per the CONTRIBUTING issue-first guidance.

Find the existing Go authentication path that calls google.JWTConfigFromJSON and read how requested scopes and the Workspace admin Subject are passed. Review google.golang.org/api/impersonate and the GOOGLE_IMPERSONATE_SERVICE_ACCOUNT condition, then verify that key-based authentication remains unchanged and add or run coverage for both credential paths.

Written by the indexing model from the issue text.