`firebase deploy` overrides members of invoker role on CloudRun service, even if `preserve_external_changes` is set to `True`

### [REQUIRED] Environment info

**firebase-tools:** 12.5.3

**Platform:** macOS

### [REQUIRED] Test case

```
from firebase_functions.scheduler_fn import on_schedule, ScheduledEvent

@on_schedule(
schedule="*/15 * * * *",
region="europe-west3",
ingress="ALLOW_INTERNAL_ONLY",
concurrency=1,
preserve_external_changes=True,
)
def update_prd_from_meeting_transcripts(event: ScheduledEvent) -> None:
print(event["job_name"], event["schedule_time"])
return
```

### [REQUIRED] Steps to reproduce
1. Deploy the example function above (scheduled function) with `firebase deploy functions --project $PROJECT_ID`
2. Create a custom service account (we use terraform, but Cloud Console would work, too)
3. Update the created CloudScheduler job to use the custom service account created in 2 (we use terraform, but Cloud Console would work, too)
4. Add a `role/run.invoker` IAM binding to the CloudRun service created in 1., with the custom service account created in 2 being one of the members.
5. Re-deploy the function or deploy an update with `firebase deploy functions --project $PROJECT_ID`

### [REQUIRED] Expected behavior
The updated function is deployed and the `role/run.invoker` on the Cloud Run service is either not updated or only updated additively in order to preserve my changes.
As using the default compute service account is discouraged as a security risk this is an important behavior to rely on for mature organisations that have a requirement **not** to use the default compute service account.

### [REQUIRED] Actual behavior
The updated function is deployed and the `role/run.invoker` on the Cloud Run service is set to contain only the default compute service account.
This is due to the following code in firebase cli:
1. Updating the CloudRun permission replaces the members for the invoker role instead of doing an additive update [here](https://github.com/firebase/firebase-tools/blob/f0c247195db10b4fa01adb8f8c9fb93d1a13f9ed/src/gcp/run.ts#L312).
2. When updating a scheduled function, its invokers are hard-coded to the default compute service account [here](https://github.com/firebase/firebase-tools/blob/f0c247195db10b4fa01adb8f8c9fb93d1a13f9ed/src/deploy/functions/release/fabricator.ts#L542).

Since this log contains a lot of sensitive information, I'd like to provide it if required, which I don't believe is the case as there is a 100% reproduction and there is a clear connection to code in the description above.