asmcli does not set up or validate a required permission for managed ASM

[brantgurga]

After some troubleshooting, it has been discovered that the Anthos Service Mesh Service Agent role needs to be on the fleet service account for the clusters (this is documented) and the fleet account (this is not documented). Without the equivalent of this, it never provisions. Using asmcli to set up managed ASM has this same issue. I've put in documentation requests to document this better too.

gcloud projects add-iam-policy-binding "PROJECT_ID"  \
  --member "serviceAccount:service-FLEET_PROJECT_NUMBER@gcp-sa-servicemesh.iam.gserviceaccount.com" \
  --role roles/anthosservicemesh.serviceAgent

The equivalent of the above needs done for cluster project IDs and the fleet project ID. Current documentation implies only cluster project IDs which makes the separate fleet project setup incomplete.