Admin user optional

Make the google_domain.admin_user configuration optional and default to null, and only authenticate with_subject if set.

This is no longer needed if not using a service account with Domain-Wide Delegation, and using Admin Roles instead.

Also, add a sanity check if no eligible users were found. Happens if not on CUDN and could have destructive results.

Part of sync-deploy#4