docs: Service Usage generateServiceIdentity authorization and versioning are undocumented

[IzaakGough]

Tracking issue for the documentation gaps found while answering #11005. These are Google Cloud documentation pages rather than anything in this repo, so this issue exists to record what needs updating and route it, not to change files here.

The CLI calls Service Usage v1beta1 services.generateServiceIdentity during gen 2 functions preparation (src/gcp/serviceusage.ts, called from src/deploy/functions/prepare.ts). Anyone building a least-privilege CI role currently has no documented way to tell what to grant for it.

Page	Gap	Could state
Service Usage access control	Method table omits services.generateServiceIdentity, while listing enable, use, get, list, disable and the quota methods	That the method checks no consumer project IAM permission
services.generateServiceIdentity reference	OAuth scopes only, no IAM permission, no behaviour when the identity already exists	The permission position, and that repeat calls return the existing identity unchanged
Create and grant roles to service agents	Documents only Workload Identity GenerateServiceAgents with workloadidentity.serviceAgents.create, no cross reference in either direction	Whether it supersedes the Service Usage RPC

Also worth stating on those pages: the method exists only in v1beta1. The v1 discovery document has no equivalent, so there is no GA endpoint to move to.

The testing behind this is in #11005: a service account with no role bindings received HTTP 200, including for services whose identity did not yet exist, while the same token was denied on services.get and services.list.

Routing for the fix: Documentation component 187166, and IAM component 187161 for the third page.