-get-gcp-jwt: correct scope, clean up call

It turns out 'devstorage.read_write' also gives us an access token
instead of a JWT, and is probably more the thing that we want.

Took the opportunity to make scope a macro to clean up the make-jwt call
site.

pkg/arvo/ted/get-gcp-jwt.hoon

@@ -31,12 +31,9 @@
 ;<  =key:rsa      bind:m  read-private-key
 ;<  kid=@t        bind:m  (read-setting %private-key-id)
 ;<  aud=@t        bind:m  (read-setting %token-uri)
+=*  scope  'https://www.googleapis.com/auth/devstorage.read_write'
 =/  jot=@t
-  %:  make-jwt
-    key  kid  iss
-    'https://www.googleapis.com/auth/cloud-platform'
-    aud  now.bowl
-  ==
+  (make-jwt key kid iss scope aud now.bowl)
 ;<  p=[access-token=@t expires-at=@da]  bind:m
   (get-access-token jot aud now.bowl)
 (pure:m !>(p))