GKE default compute engine service account

[aumohr]

Describe the bug
In stage 3-gke-multitenant, the default compute engine service account is used in GKE clusters. This is against GCP security best practices.

Rationale
The Project Editor role is assigned to the Compute Engine default service account, which grants access to all the Google Cloud resources in the project; this includes service accounts in the project which can be used for privilege escalation. If the Compute Engine default service account is assigned to a compute instance, anyone with access to the compute instance (e.g., using SSH/RDP) will have access to the attached service account, thus having access to all resources in the project. This also applies to other products that use VMs as building blocks, including GKE, Dataflow, Datalab, Cloud Composer, etc.

Expected behavior
Create a custom service account for GKE deployment and assign the minimum set of required privileges to it.