Using GCP Workload Identity Federation in Slurm Jobs on SUNK

How to use GCP Workload Identity Federation from Slurm jobs on SUNK, including projected OIDC tokens, pyxis/enroot containers, and private Artifact Registry pulls without static service account keys.