feat: managed service accounts for BYOB users

[Ziinc]

This PR adds in adding of managed SAs to BYOB users' projects. This ensures that the IAM policy updating is non-destructive. It also requires the permissions to fetch and set the IAM policies (i.e. IAM admin), and thusly this is optional depending on whether the user has enabled it.

Queries are routed through partitioned Goth servers, each service account gets their own partitioned goth server to ensure that token refreshing does not bottleneck requests.
This is only true when:

1. system has managed SAs enabled and user is not byob
2. system has managed SAs enabled, and user is BYOB and has managed SAs enabled.
   Otherwise, queries are all routed through Logflare.Goth (whcih is the main service account)

[Ziinc]

@Logflare/dashbit will need to merge this in first but a review would be appreciated 🙏

[wojtekmach]

Looks good to me!

[wojtekmach]

This is pretty subjective but in our experience, with/1 + "tagged tuples" decreases readability as one has to go back'n'forth between the "happy" path and the corresponding else clause. For me, with/1 is ideal without else clause or with a single catch-all else clause, anything other than that, to me, gives me a pause what's going on every single time.

I haven't tested it but I think this would be the equivalent:

def append_managed_sa_to_iam_policy(user) do
  if BigQueryAdaptor.managed_service_accounts_enabled?() do
    with {:ok, policy} <- get_iam_policy(user) do
      if contains_managed_service_accounts?(policy) do
        {:ok, policy}
      else
        append_managed_service_accounts(user.bigquery_project_id, policy)
      end
    end
  else
    {:error, :managed_service_accounts_disabled}
  end
end

again, pretty subjective though!

[wojtekmach]

consider adding null: false which would be safe since there's a default.