Support for GKE workload identities

Which use case/requirement will be addressed by the proposed feature?

We are building KafkaConnect on GKE and GKE has a mechanism to authenticate without issuing a ServiceAccount JSON key.
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
Since issuing JSON keys is a security risk, we would like to support GKE workload identities with Spanner connectors.

Implementation ideas (optional)

https://cloud.google.com/docs/authentication

If no JSON key is explicitly set, the Application Default Credentials mechanism can be used for proper authentication processing.