Grant the export job what it needs and nothing else

A nightly export job was given project Editor access during a migration, and its bucket was made public so the analytics team could read the exports. An access review requires the job and analysts to keep working without broad or anonymous access.

Repair bucket-policy.json for gs://acme-daily-exports.

• Permit export-writer@acme-prod.iam.gserviceaccount.com to create objects and analytics@acme.example.com to read and list them, with each principal identified by type.
• Grant no other capabilities or public access.