cloud: Standardize service account name passing

[spbnick]

It looks like we have three ways we pass around service accounts:

• Just the name, assuming the project is passed separately, and assuming the recipient knows it's a service account.
• The complete email, assuming the recipient knows it's a service account.
• The complete account name, with the serviceAccount: prefix.

This makes it difficult to figure out what is passed when without looking at the surrounding code.

See if we can unify that in as many places as possible.