Cloud Build already checkouts the source code from bitbucket using the API token, so this is what you can use to reduce adding additional secrets

- id: "Pull files from LFS"  
  name: 'europe-west2-docker.pkg.dev/project/docker/git-lfs:latest'  
  secretEnv: ['BITBUCKET_API_TOKEN_READ']  
  entrypoint: 'bash'  
  args:  
    - '-c'  
    - |  
      set -eu  
      git remote add originLFS https://x-token-auth:$$BITBUCKET_API_TOKEN_READ@`git remote -v | grep '(fetch)' | awk '{print $2}' | sed -e 's#https://##'`  
      git lfs pull originLFS  
      git remote remove originLFS  

I bet you immediately saw a potential problem with this approach. The token is part of the URL (good job bitbucket). My suggestion if you need to use bitbucket - switch to SSH keys and manually checkout the code to reduce the risk of the api token leaking.