add new identity to run terraform plan on PRs

[cpanato]

Not sure how to define the pull-request in the new identity

Related to #54

[cpanato]

ptal @mattmoor

[mattmoor]

I'm applying this now.

[mattmoor]

Terraform will perform the following actions:

  # google_project_iam_member.github_viewer will be created
  + resource "google_project_iam_member" "github_viewer" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = (known after apply)
      + project = "octo-sts"
      + role    = "roles/viewer"
    }

  # google_service_account.github_pull_requests will be created
  + resource "google_service_account" "github_pull_requests" {
      + account_id = "github-pull-requests"
      + disabled   = false
      + email      = (known after apply)
      + id         = (known after apply)
      + member     = (known after apply)
      + name       = (known after apply)
      + project    = "octo-sts"
      + unique_id  = (known after apply)
    }

  # google_service_account_iam_binding.allow_github_pull_requests_impersonation will be created
  + resource "google_service_account_iam_binding" "allow_github_pull_requests_impersonation" {
      + etag               = (known after apply)
      + id                 = (known after apply)
      + members            = [
          + "principalSet://iam.googleapis.com/projects/96355665038/locations/global/workloadIdentityPools/github-pool/attribute.sub/repo:chainguard-dev/octo-sts:pull_request",
        ]
      + role               = "roles/iam.workloadIdentityUser"
      + service_account_id = (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.