add iam workload identity federation

[modular-magician]

This is my attempt to add the new Google Workload Identity Federation resources.

fixes hashicorp/terraform-provider-google#7455

But I run into the issue that the IAM resources seem to be handwritten. Now that I add products/iam/terraform.yaml all the resources in that file get generated to terraform, including things like service_account and role.
What would be the best way to leave the handwritten iam resources alone, but still be able to add the new iam-beta resources for workload identity federation?

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

`google_iam_workload_identity_pool`

Derived from GoogleCloudPlatform/magic-modules#4071