feat: support GKE Workload Identity

[tcp]

Description

• Add service account to build & push jobs to support workload identity
• Global option to directly push to registry instead of using the local registry
• Switch to krane that supports workload identity for pushing images
• Run worker pool with the service account same as backend's service account.

Affected Dependencies

List any dependencies that are required for this change.

How has this been tested?

• Describe the tests that you ran to verify your changes.
• Provide instructions so we can reproduce.
• List any relevant details for your test configuration.

Checklist

• I have followed the Contribution Guidelines and Code of Conduct
• I have commented my code following the OpenMined Styleguide
• I have labeled this PR with the relevant Type labels
• My changes are covered by tests

[review-notebook-app]

Check out this pull request on 

See visual diffs & provide feedback on Jupyter Notebooks.

---

Powered by ReviewNB