Make service agents work in different universes (#2894)

* Make service agents work in different universes

* Use templatestring and two passes for service agent emails

* Fix tests

tools/build_service_agents.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -125,7 +125,9 @@ def main(e2e=False):
       # We keep the SERVICE_NAME part as the agent's name
       name = identity.split('@')[1].split('.')[0]
       name = name.removeprefix('gcp-sa-')
-    identity = identity.replace('PROJECT_NUMBER', '%s')
+    identity = identity.replace('PROJECT_NUMBER', '${project_number}')
+    identity = identity.replace('.iam.gserviceaccount.',
+                                '.${universe_domain}iam.gserviceaccount.')
 
     if name == 'monitoring':
       # monitoring is deprecated in favor of monitoring-notification.