[2nd-gen function] The request was not authenticated

As you know, the default service account for Eventarc, which is used by 2nd generation Cloud Functions (Cloud Run functions), is automatically attached `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.
However, this service account is not granted the Cloud Run Invoker role (run.invoker).
Therefore, Cloud Run functions via Firebase Extensions does not have permission to invoke Cloud Run functions and output following error logs as default.

> The request was not authenticated. Either allow unauthenticated invocations or set the proper Authorization header. Read more at https://cloud.google.com/run/docs/securing/authenticating Additional troubleshooting documentation can be found at: https://cloud.google.com/run/docs/troubleshooting#unauthorized-client

The issue also has been reported about the latest version(`0.2.4`) of Stream [Firestore to BigQuery](https://extensions.dev/extensions/firebase/firestore-bigquery-export), which was created by official Firebase team.
- https://github.com/firebase/extensions/issues/2412#issuecomment-2882918366
- https://github.com/firebase/extensions/issues/2412#issuecomment-2885988504

### [REQUIRED] Environment info

**firebase-tools: 14.4.0**

**Platform: macOS 15.4.1 (24E263)**

### [REQUIRED] Test case

I’m actually an extensions developer myself. You may be able to reproduce the issue by installing my extension from following pre-release link.
https://console.firebase.google.com/project/_/extensions/install?ref=htsuruo/trigger-github-issues-from-crashlytics@1.0.0-rc.0

### [REQUIRED] Steps to reproduce

1. Create Firebase empty project
2. Install any extensions using 2nd-gen functions
- ex. https://console.firebase.google.com/project/_/extensions/install?ref=htsuruo/trigger-github-issues-from-crashlytics@1.0.0-rc.0

### [REQUIRED] Expected behavior

The service agent role should add a role `roles/run.invoker` to execute Cloud Run functions(2nd-gen functions).
Totally, the deployment process should automatically grant both:

- `roles/eventarc.eventReceiver` role to the Compute Service Agent (for receiving events)
- → already implemented
- `roles/run.invoker` role to the Compute Service Agent (for invoking Cloud Run services)
- → missing

https://github.com/firebase/firebase-tools/blob/629f211c35032a2dea3343e408858b1043143af9/src/deploy/extensions/v2FunctionHelper.ts#L10

This is consistent with how regular Firebase Functions handle v2 functions with Eventarc triggers.

And ideally, the extension tool should create new service account for the Eventarc instead of default service account the following [best practice](https://cloud.google.com/iam/docs/best-practices-service-accounts#single-purpose).

### [REQUIRED] Actual behavior

Add the `roles/eventarc.eventReceiver` IAM binding policy only to `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`. This means Eventarc lacks permission to execute Cloud Run functions (2nd-generation functions).

Start in src/deploy/extensions/v2FunctionHelper.ts at the referenced deployment logic, then reproduce with an empty Firebase project and a 2nd-generation extension. Verify the deployment grants the Compute Service Agent both roles/eventarc.eventReceiver and roles/run.invoker, and confirm the extension can invoke its Cloud Run function without the authentication error.

Written by the indexing model from the issue text.