Scaffold websites require Cloud Datastore permissions, even when they don't use Cloud Datastore

If you deploy a basic scaffold App Engine app, on startup it _always_ attempts to connect to Cloud Datastore using the default service account credentials. This happens even if nothing in the app uses Cloud Datastore.

On a new App Engine project, this causes a 500 error. In the application log, you can see a message `google.api_core.exceptions.PermissionDenied: 403 Missing or insufficient permissions` that is emitted as part of the NDB datastore library.

A quick fix is to grant the default App Engine service account the required permissions.

The default App Engine service account normally gets the editor role, but this can be changed per-organization. If the GCP organization changes the default role, or removes all permissions for the service account by default, then your scaffold app can fail.

https://cloud.google.com/appengine/docs/standard/configure-service-accounts#default_service_account

The scaffold connects to the datastore in order to set/get a secret that is used by Flask for signing cookies and stuff. If the app doesn't need to do that, then we should make it so the app doesn't require access to the datastore , and avoid this error.

https://flask.palletsprojects.com/en/3.0.x/config/#SECRET_KEY

まず、Flask の SECRET_KEY を設定または取得するために使用される scaffold の起動処理と NDB datastore へのアクセスを追跡します。基本的な App Engine のデプロイパスを検証し、Datastore を使用しないアプリが、デフォルトのサービスアカウントに Datastore の権限がない場合でも、403 や 500 で失敗しなくなったことを確認します。

索引モデルが issue の本文から書いたものです。