Support Workload Identity Federation in IAM configurations

[hisomura]

Summary

This PR addresses #518 by replacing allAuthenticatedUsers with allUsers in all IAM member configurations.

Motivation

As discussed in issue #518, users cannot access bqutil resources when using Workload Identity Federation because allAuthenticatedUsers does not include federated identities.

According to Google Cloud IAM documentation:

This principal type doesn't include federated identities, which are managed by external identity providers (IdPs). If you use Workforce Identity Federation or Workload Identity Federation, don't use allAut
henticatedUsers.

Changes

• Updated 11 occurrences of allAuthenticatedUsers to allUsers in release/terraform/main.tf

Security Consideration

There is minimal security difference between allAuthenticatedUsers and allUsers for public resources, as allAuthenticatedUsers includes any Google account (not just organization members).

Fixes #518

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.