Support GCP app default credentials for backups/sidecar

[marratj]

This PR aims to support GCP application default credentials in addition to specifying a fixed Service Account JSON key, so the new GKE Workload Identity authentication for Pods can be used. See also #274

To support those two (GCP app default + Workload Identity), the following changes are necessary:

• update rclone in sidecar (GCP app default credentials are only supported from rclone 1.47.0)
• create an empty GCP service account key file for rclone in case no credentials are specified (so rclone uses app default authentication)
  • this is important for backups as well as inits of new clusters from those backups
• add the same additional Pod Spec options that the accompanying MySQL Cluster has to make sure
  • Backup Pods can use a non-default Service Account
  • Backup Pods get scheduled on Nodes that are part of the correct GKE Identity Namespace (usually the same where the MySQL StatefulSet Pods are running)
  • use the same account as the MySQL Cluster Pods to make sure they have the same identity for backups and inits to read/write from/to GCS buckets

We use this internally now successfully and welcome any feedback on this and like to contribute on that :)

[AMecea]

Thank you @marratj !