Workload identity is a GCP-specific beta feature for mapping to GCP IAM, right?