Feature - Support GCP IAM Roles for Service Accounts

/kind feature

**1. Describe IN DETAIL the feature/behavior/change you would like to see.**
GCP has support for IAM Roles using K8s service accounts, and I think it would be great if kOps could handle configuring this automatically. GKE Workload Identity [docs](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity).

kOps already supports AWS IAM Roles for service accounts [docs](https://kops.sigs.k8s.io/cluster_spec/#service-account-issuer-discovery-and-aws-iam-roles-for-service-accounts-irsa). Example of kOps cluster spec stanza:
```
spec:
serviceAccountIssuerDiscovery:
discoveryStore: s3://publicly-readable-store
enableAWSOIDCProvider: true
```

Ideally, I would define a similar stanza for `serviceAccountIssuerDiscovery` but with GCP specific values
```
spec:
serviceAccountIssuerDiscovery:
discoveryStore: gs://publicly-readable-store
enableGCPOIDCProvider: true
```

I've also found [gcp-workload-identity-federation-webhook](https://github.com/pfnet-research/gcp-workload-identity-federation-webhook) which does the same things as [amazon-eks-pod-identity-webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). Maybe kOps can add that to addons as well.

FR for AWS IAM Role for Service accounts - https://github.com/kubernetes/kops/issues/8264

**2. Feel free to provide a design supporting your feature request.**