pw_env_setup: Move -service-account-json arg

'cipd ls <path> -service-account-json foo.json' is valid but
'cipd -service-account-json foo.json ls <path>' is not. Change cipd
calls to pass this argument at the end of the command.

Bug: b/244166911
Change-Id: I4f8af61810b42df029695a15327cbaaf44aae96d
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/109511
Reviewed-by: Ted Pudlik <tpudlik@google.com>
Pigweed-Auto-Submit: Rob Mohr <mohrr@google.com>
Commit-Queue: Auto-Submit <auto-submit@pigweed.google.com.iam.gserviceaccount.com>

pw_env_setup/py/pw_env_setup/cipd_setup/update.py

@@ -33,8 +33,9 @@
 def check_auth(cipd, package_files, cipd_service_account, spin):
     """Check have access to CIPD pigweed directory."""
     cmd = [cipd]
+    extra_args = []
     if cipd_service_account:
-        cmd.extend(['-service-account-json', cipd_service_account])
+        extra_args.extend(['-service-account-json', cipd_service_account])
 
     paths = []
     for package_file in package_files:
@@ -51,7 +52,7 @@ def check_auth(cipd, package_files, cipd_service_account, spin):
 
     username = None
     try:
-        output = subprocess.check_output(cmd + ['auth-info'],
+        output = subprocess.check_output(cmd + ['auth-info'] + extra_args,
                                          stderr=subprocess.STDOUT).decode()
         logged_in = True
 
@@ -69,7 +70,8 @@ def _check_all_paths():
             # Not catching CalledProcessError because 'cipd ls' seems to never
             # return an error code unless it can't reach the CIPD server.
             output = subprocess.check_output(
-                cmd + ['ls', path], stderr=subprocess.STDOUT).decode()
+                cmd + ['ls', path] + extra_args,
+                stderr=subprocess.STDOUT).decode()
             if 'No matching packages' not in output:
                 continue
 
@@ -78,7 +80,7 @@ def _check_all_paths():
             # 'cipd instances' does use an error code if there's no such package
             # or that package is inaccessible.
             try:
-                subprocess.check_output(cmd + ['instances', path],
+                subprocess.check_output(cmd + ['instances', path] + extra_args,
                                         stderr=subprocess.STDOUT)
             except subprocess.CalledProcessError:
                 inaccessible_paths.append(path)
@@ -99,7 +101,7 @@ def _check_all_paths():
             stderr('Attempting CIPD login')
             try:
                 # Note that with -service-account-json, auth-login is a no-op.
-                subprocess.check_call(cmd + ['auth-login'])
+                subprocess.check_call(cmd + ['auth-login'] + extra_args)
             except subprocess.CalledProcessError:
                 stderr('CIPD login failed')
                 return False