Fix missing bootstrap IAM for GKE SA to create CPA clusters. (#12962)

Author: tonyzhc

mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.tmpl

@@ -5633,6 +5633,10 @@ func TestAccContainerCluster_WithCPAFeatures(t *testing.T) {
 			Member: "serviceAccount:service-{project_number}@container-engine-robot.iam.gserviceaccount.com",
 			Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
 		},
+		{
+			Member: "serviceAccount:service-{project_number}@container-engine-robot.iam.gserviceaccount.com",
+			Role: "roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation",
+		},
 	})
 
 	// Find an active cryptoKeyVersion on the signing key.