fix: adapt the iam binding update logic to the latest constraints

[shobsi]

This is needed as some recent updates to a dependency (google-cloud-resource-manager or its dependencies) broke the existing logic, and we are seeing the error like this:
--> policy.bindings.append(new_binding)
TypeError: Expected a message object, but got {'role': 'roles/run.invoker', 'members': [...]}

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes internal issues 419589974, 425442503 🦕

[shobsi]

@tswast looks like the google.iam usage was done away with in #1611, so this change is effectively reverting that. Let's discuss how should we keep things working in both external and internal environments.

[tswast]

Let's try to update google3 first. That google.iam namespace is indeed problematic

[tswast]

CC @parthea Did the gapic generator make a breaking change to no longer allow dictionary inputs?