By default the context/cluster/user entries in kubeconfig are named
gke_{project}_{location}_{cluster}, which is verbose and hard to type.
Add --alias so users can set a short, memorable name instead.
The gcloud cred helper [requests these scopes](c19c59784d/cmd/gke-gcloud-auth-plugin/default_credentials_token_provider.go (L17-L19)) when obtaining a token. Without this scope, service accounts authenticate to GKE as their unique ID, which means the RBAC policies must do the same. This is inconvenient when authoring policies since it's hard to reason about which authentication flows will use the email vs unique ID.
