fix(kuma-cp): support GC service account

[lobkovilya]

Summary

Special treatment for GC service account when checking if an operation on resources is allowed

Full changelog

• [Implement ...]
• [Fix ...]

Issues resolved

Fix #4434

Documentation

• Link to the website documentation PR

Testing

• Unit tests
• E2E tests
• Manual testing on Universal
• Manual testing on Kubernetes

Backwards compatibility

• Update UPGRADE.md with any steps users will need to take when upgrading.
• Add backport-to-stable label if the code follows our backporting policy

[codecov-commenter]

Codecov Report

Merging #4483 (fa2dba4) into master (a066dca) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #4483   +/-   ##
=======================================
  Coverage   55.43%   55.44%           
=======================================
  Files         947      947           
  Lines       58052    58053    +1     
=======================================
+ Hits        32184    32190    +6     
+ Misses      23320    23319    -1     
+ Partials     2548     2544    -4     

Impacted Files	Coverage Δ
pkg/plugins/runtime/k8s/webhooks/validation.go	86.06% <100.00%> (+0.11%)	⬆️
pkg/core/resources/manager/cache.go	85.71% <0.00%> (-2.60%)	⬇️
pkg/xds/generator/direct_access_proxy_generator.go	89.65% <0.00%> (-1.15%)	⬇️
pkg/core/secrets/manager/global_manager.go	42.42% <0.00%> (+3.03%)	⬆️
...s/authn/api-server/tokens/admin_token_bootstrap.go	86.00% <0.00%> (+4.00%)	⬆️
pkg/core/tokens/signing_key_manager.go	90.00% <0.00%> (+5.00%)	⬆️
pkg/core/tokens/default_signing_key.go	77.77% <0.00%> (+5.55%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a066dca...fa2dba4. Read the comment docs.