Got it!

Setting the scope for the service account credential is all that is needed:

    _serviceAccountCredential.Scopes = new string[]
    {
        Google.Apis.Drive.v3.DriveService.Scope.DriveReadonly
    };

I can now read the contents of my google drive folder.

[I know the StackOverflow rules prohibit answers generated by AI, but hats off to Gemini to pointing me in the right direction when I asked how to generate the token. It pointed me to this answer in StackOverflow.]