infra/gcp/iam: use --project for serviceaccount bindings
infra/gcp/iam: use --project for serviceaccount bindings

Either ensure_serviceaccount_role_binding never worked, or something has
changed recently.

For whatever reason, when running without `--project foo`, it is
impossible to use a consistent resource identifier for subcommands of
`gcloud iam service-accounts`:

- add-iam-policy-binding: expects 'projects/p/serviceAccounts/email'
- get-iam-policy: rejects the above, expects 'numeric id' or 'email'

Apparently, for add-iam-policy-binding, the project hosting the
service-account is _not_ parsed out of its email. Instead, the project
will come from:

- the fully specified name `projects/foo/serviceAccounts/email`
- `--project foo` if given
- `gcloud config get-value core/project` otherwise

ref: https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding#SERVICE_ACCOUNT

So to allow use of a consistent identifier (email) while reading or
updating service-account iam-policy, update _ensure_resource_role_binding
to optionally accept a project argument. Then parse out and pass the
project for service-accounts only (since they are thus far the only
resource to require this).

Ditto all of the above for remove-iam-policy-binding,
_ensure_removed_resource_role_binding.

I ran into this because I intentionally leave `core/project` set to a personal
project, to ensure I have to be explicit about making changes to shared
projects. When I ran ensure-main-project.sh it couldn't find the
kubernetes-public service accounts in my personal project when trying to
modify workload identity bindings on those service accounts.

kubernetes/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io