feat(secops): support service account impersonation and credential fallbacks (#250)

[dandye]

Summary

• Adds support for Google Cloud service account impersonation (SECOPS_IMPERSONATE_SERVICE_ACCOUNT / GOOGLE_IMPERSONATE_SERVICE_ACCOUNT).
• Adds support for GOOGLE_APPLICATION_CREDENTIALS fallback when SECOPS_SA_PATH is not explicitly set.
• Enables keyless, secure authentication for Cloud Run serverless deployments (where GOOGLE_APPLICATION_CREDENTIALS is blocked) and cross-cloud Kubernetes / EKS workloads using Workload Identity.
• Supports chained authentication (base worker service account key file impersonating a target SecOps service account).
• Fixes Support for service account impersonation #250.

Changes Made

• Server Authentication: Updated get_chronicle_client in server/secops/secops_mcp/server.py to dynamically construct keyword arguments for SecOpsClient (service_account_path, impersonate_service_account).
• Unit Tests: Added comprehensive unit test suite in server/secops/tests/test_secops_server_auth_unit.py covering:
  • Default ADC
  • SECOPS_SA_PATH
  • GOOGLE_APPLICATION_CREDENTIALS fallback
  • SECOPS_IMPERSONATE_SERVICE_ACCOUNT
  • GOOGLE_IMPERSONATE_SERVICE_ACCOUNT fallback
  • Chained service account key + target impersonation

Test Plan

• Ran unit test suite: 6/6 tests passed in test_secops_server_auth_unit.py.
• Ran full unit test suite: 17/17 tests passed in server/secops/tests/.

Fixes #250