GCS: Don't try to set ACLs if bucket-policy only is set

[justinsb]

This means we won't be able to work unless there's a bucket permission
(which actually will typically happen if the state store is in the
same GCS project).

This is the minimal workaround for cherry-picking.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[justinsb]

Some background: we set ACLs to enable a remote GCS bucket. But if the bucket has uniform bucket level access then we simply can't set ACLs.

For the common case where the kops-state-store GCS bucket is in the same project, we likely don't need these ACLs anyway, so this is a minimal fix to unblock functionality there, that we can cherry-pick.

Future PRs will try to handle the cross-project case, but we probably wouldn't cherry-pick them.

[rifelpet]

Looking forward to our kops-gce job turning green :)

/lgtm