feat(sa-key-rotator): add automated service account key rotation tool and playbook

[meet2mky]

Description

This PR introduces the Service Account Key Rotator tool under sa-key-rotator/ for automating monthly IAM Service Account key rotation and Secret Manager synchronization for GCSFuse integration tests.

Because IAM service account keys have a strict 90-day expiration lifetime, this tool automatically generates new keys in-memory on the 1st of every month, updates Secret Manager with the latest version, destroys older Secret Manager versions to avoid sprawl, and deletes older IAM keys to prevent quota exhaustion.

Key Features & Components

1. rotate_sa_keys.sh:
   • In-memory key generation and Secret Manager upload (no key files written to disk).
   • Automated older Secret Manager version destruction (keeps only the latest active version).
   • Automated pruning of older user-managed IAM service account keys.
   • Decoupled target configuration via SECRET_CONFIGS env var with strict upfront validation.
   • Built-in DRY_RUN mode (default) and auto-formatted summary tables using standard column utility.
2. deploy.sh:
   • Single-command automated deployment script that checks prerequisites, enables APIs, sets up Service Accounts and IAM permissions, creates Artifact Registry Docker repo, runs Cloud Build, and creates/updates the Cloud Run Job and Cloud Scheduler monthly trigger.
3. Dockerfile:
   • Container specification based on google/cloud-sdk:alpine with jq and util-linux.
4. README.md:
   • Comprehensive documentation with styled Mermaid architecture diagram, minimal IAM security matrix, project whitelisting prerequisites, and operations guide.

Verification

• Verified rotate_sa_keys.sh in dry-run mode across gcs-fuse-test and gcs-fuse-test-ml targets.
• Deployed and verified Cloud Run Job and Cloud Scheduler trigger via deploy.sh.

[gemini-code-assist]

Code Review

This pull request introduces an automated Service Account key rotation system for GCSFuse integration tests, including a Dockerfile, a deployment script, a playbook, and the core rotation script. The review feedback identifies two critical issues in the rotation script: a potential security vulnerability where the private key could be leaked to logs if key generation or parsing fails, and a safety concern where an empty active key ID could lead to the accidental deletion of all user-managed keys. Both comments are highly actionable and should be addressed.