chore: make event_aggregates tables readable by ads workgroup

[curtismorales]

Description

Edits the workgroup access of the event_aggregates and event_aggregates_suggest tables and views in contextual_services[_derived]. These are now readable by both members of the contextual-services workgroup and members of the ads workgroup.

See #9887 for more context. In brief, we have already done this for the newer versions of these tables, ads_derived.event_aggregates_suggest_v1 (Suggest data) and ads_derived.ad_metrics_v1 (Tiles data). This is in service to deprecating everything in contextual_services_derived and removing membership in the contextual-services workgroup to access anything in BigQuery other than the raw ping data.

Related Tickets & Documents

Reviewer, please follow this checklist

[github-actions]

This PR adds table-level workgroup_access blocks granting roles/bigquery.dataViewer to workgroup:ads/data-viewers and workgroup:contextual-services/data-viewers on the event_aggregates/event_aggregates_suggest views in contextual_services and their backing _v1 tables in contextual_services_derived.

Granting the ads workgroup at the table level (rather than widening the dataset) matches the stated goal of exposing just these four objects, and covering both the views and the underlying derived tables is what ads members need to read through the views. The one problem is the second member in each block: workgroup:contextual-services/data-viewers is already granted at the dataset level in both dataset_metadata.yaml files, and bqetl metadata validate-workgroups treats a table-level repeat of a dataset-level grant as an error, so the Validate Metadata job will reject all four files as written.

Reviewer checklist notes: no schema or backfill.yaml changes are involved, no new dataset is introduced, and the branch lives in this repo so CI runs. contextual_services/contextual_services_derived are not in CODEOWNERS, so the restricted-namespace change control procedure doesn't apply here — though since this is an access-control change, sign-off from a contextual-services data owner is worth having on the record.

[scholtzan]

Integration report

• View full diff, if available (SQL + DAGs) (requires private-bigquery-etl access)
• Private CI run
• Bigeye monitoring dry-run: ✅ plan clean — view plan (requires private-bigquery-etl access)