Support resource-level IAM grants

[pdewilde]

TL;DR

Currently only org, folder, and project are accepted for resource. It would be nice if any resource could be supported. I'm not sure of the viability, but seems worth looking into to ensure least privilege.

https://github.com/abcxyz/access-on-demand/blob/5792d1bb468881d405ab0683fbef5b9229d5cbd1/pkg/handler/iam_handler.go#L48C22-L48C31

Detailed design

Alternatives considered

Additional information

No response

[pdewilde]

Apparently this may require adding broader IAM permissions to the AOD servieAccount