gcs: Fixed scopes for inline ServiceAccount option.

Without this that option was unusable.

Signed-off-by: Bartek Plotka <bwplotka@gmail.com>

pkg/objstore/gcs/gcs.go

@@ -54,14 +54,15 @@ func NewBucket(ctx context.Context, logger log.Logger, conf []byte, component st
 
 	// If ServiceAccount is provided, use them in GCS client, otherwise fallback to Google default logic.
 	if gc.ServiceAccount != "" {
-		credentials, err := google.CredentialsFromJSON(ctx, []byte(gc.ServiceAccount))
+		credentials, err := google.CredentialsFromJSON(ctx, []byte(gc.ServiceAccount), storage.ScopeFullControl)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to create credentials from JSON")
 		}
 		opts = append(opts, option.WithCredentials(credentials))
 	}
 
 	opts = append(opts,
+		option.WithScopes(storage.ScopeFullControl),
 		option.WithUserAgent(fmt.Sprintf("thanos-%s/%s (%s)", component, version.Version, runtime.Version())),
 	)