What stateful security policies do Google Cloud Firewall Rules enforce when regulating ingress and egress communication across Virtual Private Cloud networks? Furthermore, why is targeting specific service accounts and network tags rather than static IP subnets the definitive approach to implementing granular microsegmentation?