fix: add iam.serviceAccountUser role to gitlab-ci-sa

serviceAccountAdmin allows managing SAs but not assigning them to
resources. serviceAccountUser is required to attach a SA to GKE
node pools and other compute resources.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>