Pascal/signed url continued

[Pascal-Delange]

Service account permissions to be checked and adjusted manually and terraformed in another PR

Prereq for checkmarble/marble-frontend#319

[Pascal-Delange]

I found this alternative which seemed to work better when running locally :

func (repo *GcsRepositoryImpl) GenerateSignedUrl(ctx context.Context, bucketName, fileName string) (string, error) {
	serviceAccount := "[email protected]"
	c, err := credentials.NewIamCredentialsClient(ctx)
	if err != nil {
		panic(err)
	}

	// This code will typically not run locally if if you target the real GCS repository, because SignedURL only works with service account credentials (not end user credentials)
	// Hence, run the code locally with the fake GCS repository always
	bucket := repo.getGCSClient(ctx).Bucket(bucketName)
	return bucket.
		SignedURL(
			fileName,
			&storage.SignedURLOptions{
				Method: http.MethodGet,
				GoogleAccessID: serviceAccount,
				SignBytes: func(b []byte) ([]byte, error) {
					req := &credentialspb.SignBlobRequest{
						Payload: b,
						Name:    serviceAccount,
					}
			 	resp, err := c.SignBlob(ctx, req)
					if err != nil {
						panic(err)
					}
					return resp.SignedBlob, err
				},
				Expires: time.Now().Add(signedUrlExpiryHours * time.Hour),
			},
		)
}

But only when using application-default credentials that impersonate a service account - so not practical