infra/gcp/main: let trusted prow deploy to aaa

[spiffxp]

Part of #2151

Companion PR to kubernetes/test-infra#22970
though they can be merged in any order

Use the same service account that currently deploys kubernetes resources
to the k8s-infra prow build clusters, using the same role

Pros:

• the role is setup to disallow cluster deletion
• we already trust this today
• this is way less boilerplate

Cons:

• the role is more privileged than the namespace-user role
• wider blast radius if the one service account is compromised

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ameukam]

/lgtm
/hold
Remove hold when ready to deploy.

[spiffxp]

/assign @thockin
PTAL for review at some point, I'd like to get your input on how much we should prioritize doing better than this from a blast-radius-reduction perspective

[spiffxp]

/hold cancel

[spiffxp]

$ ./infra/gcp/ensure-main-project.sh
# ...
Empowering cluster users and admins for clusters in: kubernetes-public
  Empowering cluster admins
  Empowering prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com to deploy to clusters in project: kubernetes-public
  Updated IAM policy for project [kubernetes-public].
  @@ -54,6 +54,8 @@
     role: roles/secretmanager.secretAccessor
   - member: serviceAccount:[email protected]
     role: roles/editor
  +- member: serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
  +  role: organizations/758905017065/roles/container.deployer
   - member: serviceAccount:[email protected]
     role: roles/compute.serviceAgent
   - member: serviceAccount:service-127754664067@container-engine-robot.iam.gserviceaccount.com
  Empowering cluster users
# ...