Support configuring impersonated token lifetime in generated WIF credentials #540

TL;DR

Allow configuring the service account access token lifetime in the generated WIF credentials file for downstream tools such as gcloud.
Currently, access_token_lifetime only applies to the action's access_token output.

Detailed design

The generated WIF credentials file does not currently specify an impersonated token lifetime, so downstream tools such as gcloud use the default of 1 hour. Allowing shorter lifetimes would reduce how long a leaked access token remains usable.

An optional input such as service_account_impersonation_lifetime could set service_account_impersonation.token_lifetime_seconds in the generated file. This would avoid manually modifying the JSON while preserving existing behavior when omitted.

Additional information

I'm happy to submit a PR if this approach is acceptable.