Lear queue-services: can possibly avoid verify GCP jwt in message endpoints

Topic came up while deploying a new queue service (digital credentials) to GCP and discussing with @bolyachevets . Unrelated to the digital credentials service in particular, but applies to all the ones in lear/queue-services.

In [Lear queue-services](https://github.com/bcgov/lear/tree/main/queue_services), at the time of writing, the following:
- business-bn
- business-digital-credentials
- business-emailer
- business-filer
- business-pay

in the `worker()` handler ([example](https://github.com/bcgov/lear/blob/main/queue_services/business-bn/src/business_bn/resources/business_bn.py#L58)) they all do
```
if msg := verify_gcp_jwt(request):
current_app.logger.info(msg)
return {}, HTTPStatus.FORBIDDEN
```
and also [implement ](https://github.com/bcgov/lear/blob/main/queue_services/business-bn/src/business_bn/services/gcp_auth.py#L41) (almost) duplicate `verify_gcp_jwt` functions. That use env vars for audience claims.

This may be able to be removed per Andriy's notes about how SBC Auth and Pay things handled it. An Invoker permission can possible be added on the deployment so only the particular pubsub account used in the push can make the call.

Discussion in one of the queue services being added:
https://github.com/bcgov/lear/pull/3647#discussion_r2226924436

Note from chat: "We had it originally, because we were using pubsub in openshift first, lear was kind of behind and only now switching to pubsub at the same time as main migration, possible just using outdated design"

---
**Dev Notes**
Not sure how to set up the Invoker permission, but can check with someone who's implemented this.

Can likely remove the `gcp_auth` files from the services entirely if that gets set up. And then they wouldn't need the `SUB_AUDIENCE` and `SUB_SERVICE_ACCOUNT` environment variables, removing the need for some 1password mappings as well.

SBC Auth equivalent change: https://github.com/bcgov/sbc-auth/pull/3080

SBC Pay: https://github.com/bcgov/sbc-pay/pull/1778

Would need to use this gcp-queue version: https://github.com/bcgov/sbc-auth/blob/edc2fc315442b1b6048cf56bec3d9a93f63bd144/auth-api/pyproject.toml#L50

---
**QA Notes**
This would affect any successful message handling calls, so after Invoker permission setup and code change/config removal/deployment, basic regression that message handling works for each queue service would suffice. Should confirm with appropriate QA resources at the time though.