Use dedicated service account for each Cloud Function

[cisaacstern]

In #6, I moved the webhook cred into the Secrets Manager API, and granted the default runtime service account read access to it:

dataflow-status-monitoring/terraform/secrets.tf

Lines 21 to 23 in 98846c2

	role = "roles/secretmanager.secretAccessor"
	members = [
	"serviceAccount:${var.project}@appspot.gserviceaccount.com",

Here's the SO post which made me realize that was necessary and the place in the GCP docs it references.

For a more fine-grained permission structure down the line, we could also make a dedicated service account for each function.

This seemed to add unnecessary complexity at this early stage of the project, but may be worth keeping in mind as we grow.

cc @sharkinsspatial @rabernat (No action needed now AFAICT, just keeping you both in the loop.)

[cisaacstern]

Note that while this structure is currently used for GitHub repository dispatch PATs, we can use the same approach for FastAPI credentials once we move registrar functionality into pangeo-forge-orchestrator.