Add support to grant Network User role on a subnet to service accounts created by the project factory

[apichick]

At the moment it is not possible to assign the Network User role on a subnet to a service account that is created by the project factory in just one execution. You need to first execute it an create the service account and then grant the role in a second execution. It is not possible to refer to the service account with a key for the grants as it is shown in the yaml example.