fix(functions): cleanup declarative security service account when codebase functions are deleted (#10928)

* fix(functions): cleanup declarative security service account when codebase functions are deleted

Fixes an issue where deleting all functions in a codebase that uses declarative security (requireRoles) failed or left the managed service account (firebase-fn-...) orphaned in GCP IAM.

Specifically:
- In discoverSecurityDetails: When wantBackend has 0 endpoints, skip IAM permission checks, role queries, and managed SA generation. Return existing security metadata if an existing SA was deployed, or {} if both want and have backends are empty.
- In createDeploymentPlan: Require hasWantEndpoints to be true before treating declarative security as active. If wantBackend has 0 endpoints and haveBackend has an existing managed SA, set serviceAccountToDelete = existingManagedSA so the service account is cleanly deleted. If both wantBackend and haveBackend are empty, no service account is created or deleted.

- Deleting all functions from a codebase while keeping requireRoles in global options: verified that serviceAccountToDelete is set and the managed service account is deleted.
- Deploying an empty codebase with requireRoles specified (0 functions in want and have): verified that no service account is created and no IAM permission errors are thrown.
- Deploying functions with requireRoles: verified managed service account creation and role assignment works normally.
- Partial function deployments (--only functions:func1): verified managed service account is retained.

- npx mocha src/deploy/functions/release/planner.spec.ts src/deploy/functions/prepare.spec.ts
- firebase deploy --only functions

* fix(functions): ensure existingManagedSA is typed string | undefined in prepare.ts

* refactor(functions): extract DECLARATIVE_SECURITY_ETAG_LABEL constant and enhance JSDoc