fix(functions): defer secret access granting to release phase to prevent SA 404 race condition (#10983)

* fix(functions): defer secret access granting to release phase to prevent SA 404 race condition

### Description
Refactors secret access permission granting during Cloud Functions deployment:
- Refactors ensure.secretAccess into ensure.secretsAccessDelta (to calculate secret-to-service-account mappings), ensure.checkSecretAccess (for dry-run output), and ensure.grantSecretAccess (to grant IAM permissions per secret).
- Attaches secretAccessPlan to CodebasePlan in planner.ts.
- In prepare.ts, computes secretsAccessDelta and runs checkSecretAccess only during --dry-run. Added explicit comments noting that actual grants take place in release.
- In fabricator.ts, enqueues grantSecretAccess execution after grantNewRoles() runs (ensuring service accounts are created first) with retryPredicates: [isTransientError, isServiceAccount404] to gracefully handle GCP IAM propagation delays.

### Scenarios Tested
- Ran unit test suite covering executor.spec.ts, ensure.spec.ts, planner.spec.ts, fabricator.spec.ts, and lifecycle.spec.ts (182 passing).
- Verified npm run lint:changed-files and npm run build.

### Sample Commands
- firebase deploy --only functions
- firebase deploy --only functions --dry-run

* refactor(functions): remove obsolete ensure.secretAccess wrapper function

* fix(functions): cleanup unused variables and format files

* refactor(functions): convert secret access functions to options object parameters