Service account impersonation

Mint short-lived tokens for a service account from your own credentials.

An impersonation session calls the IAM Credentials API to mint a token for a service account. rolle also writes an impersonated ADC file so client libraries pick it up.

rolle session add gcp-impersonate \
  --name deployer \
  --project my-project \
  --service-account deployer@my-project.iam.gserviceaccount.com
rolle start deployer