user impersonation on BigQuery

[gjesse]

We'd like to be able to take advantage of user impersonation on bigquery similar to how we do on trino, but it appears the way google supports impersonation is kind of annoying in this regard.

There is current support for impersonated_service_account , but this isn't really useful for us as it lets a single user take on the service account's permissions when we want the opposite - the service account should take on the permissions of the user.

Google Cloud can support user impersonation from service accounts via domain-wide-delegation. There's no support for this in sqlmesh currently.

It looks like the credentials would need to be created with a SUBJECT field for the user to impersonate - eg:

   credentials = service_account.Credentials.from_service_account_info(
         info=None, # info will be loaded from env var or key file location
         scopes=SCOPES,
         subject=USER_TO_IMPERSONATE
     )

It would take more beyond supporting a subject though. Some refactoring of how the credentials are created so that each model could be run with a separate credentials object created on behalf of the model owner would need to be done.