feat: Add agent authentication based on instance ID (#336)

* feat: Add agent authentication based on instance ID

Each cloud has it's own unique instance identity signatures, which
can be used for zero-token authentication. This change adds support
for tracking by "instance_id", and automatically authenticating
with Google Cloud.

* Add test for CLI

* Fix workspace agent request name

* Fix race with adding to wait group

* Fix name of instance identity token

provisioner/terraform/provision.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 
 	"github.com/hashicorp/terraform-exec/tfexec"
@@ -245,9 +246,17 @@ func (t *terraform) runTerraformApply(ctx context.Context, terraform *tfexec.Ter
 	resources := make([]*proto.Resource, 0)
 	if state.Values != nil {
 		for _, resource := range state.Values.RootModule.Resources {
+			var instanceID string
+			if gcpInstanceID, ok := resource.AttributeValues["instance_id"]; ok {
+				instanceID, ok = gcpInstanceID.(string)
+				if !ok {
+					return xerrors.Errorf("invalid type for instance_id property: %s", reflect.TypeOf(gcpInstanceID).String())
+				}
+			}
 			resources = append(resources, &proto.Resource{
-				Name: resource.Name,
-				Type: resource.Type,
+				Name:       resource.Name,
+				Type:       resource.Type,
+				InstanceId: instanceID,
 			})
 		}
 	}