Fix CICD SA access

[c-jason-kim]

The stage2 CICD SAs were not being granted roles/iam.serviceAccountTokenCreator on the corresponding stage2 SAs. For whatever reason the code was appending "-prod" to the cicd-sa-ro/rw keys when adding them resulting in nulls.

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[ludoo]

Thanks for spotting this. Our mistake, this escaped in the large set of changes we recently did to resman.

[ludoo]

Can you sign the CLA and fix the linting error?

[c-jason-kim]

Apologies, obviously wasn't paying enough attention last night. Signed and linted.