UID2-7146: Switch GCP workflows to dedicated service accounts

[BehnamMozafari]

Switches the GCP OIDC publish workflow to `vars.GCP_PUBLISH_SERVICE_ACCOUNT` and the E2E test workflow to `vars.GCP_E2E_SERVICE_ACCOUNT`. This removes the operator repo's dependency on the admin SA (`github@uid2-cicd`), which after gcp-infra PR 2 will be restricted to `gcp-infra` main-branch applies only.

Note (manual step required before this PR is functional): Add `GCP_PUBLISH_SERVICE_ACCOUNT` and `GCP_E2E_SERVICE_ACCOUNT` as repo-level variables in GitHub Actions settings. The legacy `GCP_SERVICE_ACCOUNT` variable can be deleted after this PR merges and the new vars are confirmed working.

• `GCP_PUBLISH_SERVICE_ACCOUNT` = `github-publish@uid2-cicd.iam.gserviceaccount.com`
• `GCP_E2E_SERVICE_ACCOUNT` = `github-e2e@uid2-cicd.iam.gserviceaccount.com`

Part of UID2-7146 (step 2 of 4 — gated on gcp-infra PR 1 being applied to create the new SAs).

🤖 Generated with Claude Code

---

Smoke tests (run on bmz-UID2-7146-restrict-deployment-role)

Both new service accounts validated before review. GCP_PUBLISH_SERVICE_ACCOUNT and GCP_E2E_SERVICE_ACCOUNT repo vars are set.

✅ Publish — github-publish@uid2-cicd — run 26856360314 (publish-gcp-oidc-enclave-docker.yaml, Snapshot)

• "Authenticate with Google Cloud" + GCP Registry login succeeded as github-publish@uid2-cicd
• Image built, vuln-scanned (CRITICAL,HIGH), and pushed to GHCR + GAR: us-docker.pkg.dev/uid2-prod-project/iabtechlab/uid2-operator:5.70.118-alpha-228-SNAPSHOT-gcp-oidc

✅ E2E — github-e2e@uid2-cicd — run 26856542004 (run-e2e-tests-on-operator.yaml, gcp/UID2/mock, operator_image_version=5.70.118-alpha-228-SNAPSHOT-gcp-oidc)

• Confidential VM ci-test-32653 created with --service-account github-e2e@uid2-cicd and reached RUNNING; gcloud compute instances describe returned its IP; cleanup deleted it (no lingering VM)
• Run reports overall failure only at the post-VM operator healthcheck (/ops/healthcheck, "Max attempts reached") — a VM-boot/attestation/mock-connectivity issue, independent of the SA swap (the VM was already provisioned under the new SA before the healthcheck began)
• Note: this workflow needs a real operator_image_version; the default latest has no GCP image in GAR (first attempt failed at "Prepare GCP metadata" for that reason)