Fix Workload Identity for ASM in GKE hub module

[valeriobponza]

Two fixes:

• the cluster should be in the form of "//container.googleapis.com/CLUSTER_RESOURCE_NAME" - I don't think this is particularly relevant, but it's such a small change
• the condition on when to create the authority seemed to be inverted (it should be created if contains is true, but written that way I think it doesn't create it when contains is true)