Add service account impersonation example to Google Cloud docs and README

[jackwotherspoon]

Add detailed steps for SA impersonation with Proxy:

Feedback from #2338 :

For the record, these are the key steps I had to take:

• Cloud SQL instance has flag cloudsql.iam_authentication=ON
• Cloud SQL user for the SA is created with type IAM (service account)
• SA has Cloud SQL Client and Cloud SQL Instance User roles on the same project than the Cloud SQL instance
• Principal impersonating the service account is granted Service Account Token Creator for the service account impersonated (SA acting as a resource and not a member here)

Our help message has an example but we should add a README section and Google Cloud docs section as well.

cloud-sql-proxy/cmd/root.go

Lines 193 to 205 in 9cb444c

	Service Account Impersonation
	The Proxy supports service account impersonation with the
	--impersonate-service-account flag and matches gclouds flag. When enabled,
	all API requests are made impersonating the supplied service account. The
	IAM principal must have the iam.serviceAccounts.getAccessToken permission or
	the role roles/iam.serviceAccounts.serviceAccountTokenCreator.
	For example:
	./cloud-sql-proxy \
	--impersonate-service-account=impersonated@my-project.iam.gserviceaccount.com
	my-project:us-central1:my-db-server