feat(gkehub): update the api

#### gkehub:v1

The following keys were added:
- schemas.Authority.properties.scopeTenancyIdentityProvider (Total Keys: 2)
- schemas.Authority.properties.scopeTenancyWorkloadIdentityPool (Total Keys: 2)

#### gkehub:v1alpha

The following keys were added:
- schemas.Authority.properties.scopeTenancyIdentityProvider (Total Keys: 2)
- schemas.Authority.properties.scopeTenancyWorkloadIdentityPool (Total Keys: 2)

#### gkehub:v1beta

The following keys were added:
- schemas.Authority.properties.scopeTenancyIdentityProvider (Total Keys: 2)
- schemas.Authority.properties.scopeTenancyWorkloadIdentityPool (Total Keys: 2)

#### gkehub:v1beta1

The following keys were added:
- schemas.Authority.properties.scopeTenancyIdentityProvider (Total Keys: 2)
- schemas.Authority.properties.scopeTenancyWorkloadIdentityPool (Total Keys: 2)

Author: yoshi-automation

docs/dyn/gkehub_v1.projects.locations.memberships.html

@@ -137,6 +137,8 @@ <h3>Method Details</h3>
     &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
     &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters, it must use `location` rather than `zone` for GKE clusters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
     &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+    &quot;scopeTenancyIdentityProvider&quot;: &quot;A String&quot;, # Optional. Output only. The identity provider for the scope-tenancy workload identity pool.
+    &quot;scopeTenancyWorkloadIdentityPool&quot;: &quot;A String&quot;, # Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
     &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
   },
   &quot;clusterTier&quot;: &quot;A String&quot;, # Output only. The tier of the cluster.
@@ -334,6 +336,8 @@ <h3>Method Details</h3>
     &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
     &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters, it must use `location` rather than `zone` for GKE clusters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
     &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+    &quot;scopeTenancyIdentityProvider&quot;: &quot;A String&quot;, # Optional. Output only. The identity provider for the scope-tenancy workload identity pool.
+    &quot;scopeTenancyWorkloadIdentityPool&quot;: &quot;A String&quot;, # Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
     &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
   },
   &quot;clusterTier&quot;: &quot;A String&quot;, # Output only. The tier of the cluster.
@@ -486,6 +490,8 @@ <h3>Method Details</h3>
         &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
         &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters, it must use `location` rather than `zone` for GKE clusters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
         &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+        &quot;scopeTenancyIdentityProvider&quot;: &quot;A String&quot;, # Optional. Output only. The identity provider for the scope-tenancy workload identity pool.
+        &quot;scopeTenancyWorkloadIdentityPool&quot;: &quot;A String&quot;, # Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
         &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
       },
       &quot;clusterTier&quot;: &quot;A String&quot;, # Output only. The tier of the cluster.
@@ -597,6 +603,8 @@ <h3>Method Details</h3>
     &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
     &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters, it must use `location` rather than `zone` for GKE clusters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
     &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+    &quot;scopeTenancyIdentityProvider&quot;: &quot;A String&quot;, # Optional. Output only. The identity provider for the scope-tenancy workload identity pool.
+    &quot;scopeTenancyWorkloadIdentityPool&quot;: &quot;A String&quot;, # Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
     &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
   },
   &quot;clusterTier&quot;: &quot;A String&quot;, # Output only. The tier of the cluster.

docs/dyn/gkehub_v1.projects.locations.scopes.html

@@ -366,6 +366,8 @@ <h3>Method Details</h3>
         &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
         &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters, it must use `location` rather than `zone` for GKE clusters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
         &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+        &quot;scopeTenancyIdentityProvider&quot;: &quot;A String&quot;, # Optional. Output only. The identity provider for the scope-tenancy workload identity pool.
+        &quot;scopeTenancyWorkloadIdentityPool&quot;: &quot;A String&quot;, # Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
         &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
       },
       &quot;clusterTier&quot;: &quot;A String&quot;, # Output only. The tier of the cluster.