BigQuery: support ADC/WIF-based service account impersonation to avoid JSON keys #7767

We use multiple BigQuery data sources in Redash, each mapped to a different service account for dataset-level isolation. Today, that effectively means storing a JSON key per data source, because the standard BigQuery runner uses jsonKeyFile when a per-data-source identity is needed, and only falls back to ADC when no key is configured.

We would like to use a more secure setup based on ADC / OIDC / Workload Identity Federation, without long-lived JSON keys, while still being able to choose a different effective service account per BigQuery data source.

This seems adjacent to #5760, but the goal is different:

• Support BigQuery access using Account Delegation (Impersonation) #5760 focuses on impersonating the authenticated end user for audit / column-level access purposes.
• This request is about impersonating a target service account from a Redash runtime identity obtained via ADC/WIF, so each data source can use a different service account without uploading JSON keys.

Proposed direction:

• Keep the current jsonKeyFile path for backward compatibility.
• Add an optional field such as impersonatedServiceAccount to the BigQuery data source configuration.
• When jsonKeyFile is not set, use google.auth.default() as the source credential.
• If impersonatedServiceAccount is set, create BigQuery credentials via google.auth.impersonated_credentials.Credentials.

This would allow deployments on GKE / Cloud Run / GCE / EKS with Workload Identity or other ADC-compatible setups to avoid key distribution entirely, while still preserving per-data-source IAM separation.

A related issue is #7332, which shows there is already interest in ADC-based BigQuery usage, although that one is specifically about the Test Connection behavior.

Would maintainers be open to this direction? If yes, I can put together a PR for the BigQuery query runner and tests.