fix(functions): use endpoint service accounts for Eventarc IAM

[IzaakGough]

Summary

Fixes #10507.

ensureServiceAgentRoles now grants roles/run.invoker and roles/eventarc.eventReceiver to runtime service accounts from the deploy backend (including setGlobalOptions({ serviceAccount })), instead of always using gce.getDefaultServiceAccount().

Complements #9598 (#8841) for GCF v2 create/update.

Test plan

• checkIam.spec.ts (new + updated cases)
• Manual: first Storage deploy + deleted default compute + custom SA → IAM step passes; create 404 remains until fix(functions): Set serviceAccount for Cloud Functions when custom service account is specified #9598

[gemini-code-assist]

Code Review

This pull request refactors the IAM binding logic to support custom service accounts for Cloud Functions (v2). It introduces resolveRuntimeServiceAccounts to handle service account resolution and obtainComputeServiceAgentBindings to generate bindings for multiple accounts. Feedback indicates a logic issue where Eventarc roles are only granted during the initial deployment, potentially missing custom accounts added later. Additionally, a more idiomatic approach using a Set was suggested for deduplicating service accounts to avoid issues when the default account is explicitly specified.