Proposal: Add -impersonate-service-account flag

[pokutuna]

I'm aware this tool is now partially integrated into gcloud run services proxy, but I find it useful for accessing IAP-protected services without modifying the application.

Proposal

Add a new -impersonate-service-account flag that uses google.golang.org/api/impersonate to generate ID tokens with the correct audience.

This enables access to IAP-protected services with gcloud auth application-default login, without needing service account key files.

Usage

cloud-run-proxy \
  -host "https://iap-protected-app.example.com" \
  -audience "SA_UNIQUE_ID" \
  -authorization-header "Authorization" \
  -impersonate-service-account "my-sa@my-project.iam.gserviceaccount.com"

The user needs roles/iam.serviceAccountTokenCreator on the target service account.