GCP privilege escalation with serviceAccounts.getAccessToken

iam.serviceAccounts.getAccessToken over a more privileged service account lets you mint its token and inherit its access.