Storage Notification IAM permission example

[dror-g]

File: docs/reference/pkg/gcp/storage/notification.md

Hi, the doc suggests an example for granting permissions for the Storage project Service Account to publish to Pub/Sub.
I suggest such an example, which is currently missing, be included as it's a bit tricky.

I also used pubsub.TopicIAMMember to grant the storage SA role/pubsub.publisher on the topic itself rather than project-wide "projects.topics.publish" on the SA,
Not sure what's the best approach but might be worth a mention.
Cheers

[rshade]

@dror-g does the current example meet your needs? it seems to set the binding to:

const binding = new gcp.pubsub.TopicIAMBinding("binding", {
    topic: topic.id,
    role: "roles/pubsub.publisher",
    members: [gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`)],
});