Scaffold websites require Cloud Datastore permissions, even when they don't use Cloud Datastore

If you deploy a basic scaffold App Engine app, on startup it _always_ attempts to connect to Cloud Datastore using the default service account credentials. This happens even if nothing in the app uses Cloud Datastore.

On a new App Engine project, this causes a 500 error. In the application log, you can see a message `google.api_core.exceptions.PermissionDenied: 403 Missing or insufficient permissions` that is emitted as part of the NDB datastore library.

A quick fix is to grant the default App Engine service account the required permissions.

The default App Engine service account normally gets the editor role, but this can be changed per-organization. If the GCP organization changes the default role, or removes all permissions for the service account by default, then your scaffold app can fail.

https://cloud.google.com/appengine/docs/standard/configure-service-accounts#default_service_account

The scaffold connects to the datastore in order to set/get a secret that is used by Flask for signing cookies and stuff. If the app doesn't need to do that, then we should make it so the app doesn't require access to the datastore , and avoid this error.

https://flask.palletsprojects.com/en/3.0.x/config/#SECRET_KEY