New attack technique: Create Workload Identity Federation Pool and Provider (gcp.persistence.create-workload-identity-federation)

[Minosity-VR]

What does this PR do?

Adds a new GCP attack technique gcp.persistence.create-workload-identity-federation that establishes a persistent backdoor by creating a WIF pool with an X.509 provider, allowing any machine holding a certificate signed by an attacker-controlled CA to impersonate a target service account without creating a service account key.

Also bumps google.golang.org/api from v0.218.0 to v0.230.0 (the minimum version that includes X.509 WIF types in iam/v1). The go version requirement is unchanged at go 1.23.0.

Motivation

GCP parity effort with existing AWS techniques (analogous to aws.persistence.rolesanywhere-create-trust-anchor).

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

Test results

• Technique detonates successfully
• Detection log identified (google.iam.admin.v1.CreateWorkloadIdentityPool and google.iam.admin.v1.CreateWorkloadIdentityPoolProvider)