Restrict Cloud Function access

[spbnick]

At the moment all Cloud Functions run using the default App Engine service account, which has the project-wide "Editor" role (roles/editor), giving them a lot of access across the whole project.

This is not safe in general, and we should create specific service accounts for particular subsystems, give them only the required roles, and run the corresponding functions with them.