Make sure the script is published and accessible by anyone with the link (or public), as Gmail will send a server-to-server request to that url.
To make sure the script is accessible, you can send a test request with cURL. If that returns without errors, then Gmail will be able to hit the same endpoint.
I tried your code and it works fine when permissions are set correctly.