Support referencing SA created for roleset in roleset binding definition

[willdeuschle]

We would like to apply the roles/iam.serviceAccountTokenCreator role to the service account created for a roleset. This is needed to perform an IAM login against vault, among other things.

This is not possible today because the service account is created after the roleset is created (meaning we have no way to reference it when defining the roleset). Instead, we have to bind the role to our entire project, which is overly permissive. For example:

resource "//cloudresourcemanager.googleapis.com/projects/my-project" {
  roles = [
    "roles/iam.serviceAccountTokenCreator",
  ]
}

The addition I'm proposing would be a special reference to the service account being created for a roleset. For example, the roleset binding could look like:

resource "$ROLESET_SERVICE_ACCOUNT" {
  roles = [
    "roles/iam.serviceAccountTokenCreator",
  ]
}

After creating the service account, while creating the IAM policies, the plugin would substitute the service account resource it just created in place of$ROLESET_SERVICE_ACCOUNT.

Is this a contribution that would be accepted?