A security auditor asks you to produce the exact list of principals and roles currently bound directly on a specific Cloud Storage bucket named 'finance-reports'. They want the raw policy bindings for that single bucket only, not inherited grants from the project. Which gcloud command should you run?