Ensure permissions to impersonate a service account are not granted at project level

Granting users or service accounts with one of the roles: roles/iam.workloadIdentityUser / roles/iam.serviceAccountUser / roles/iam.serviceAccountTokenCreator will in practice grant them with all of the permissions of the service accounts in the project, which violates the principle of least privilege. These roles needs to be granted at the service account level and not project level.