feat(auth): support external_account_authorized_user credentials

[SamuelXing]

Fixes #7224

Workforce Identity Federation users who sign in with gcloud auth application-default login --login-config=... get an ADC file of type external_account_authorized_user. ADC currently rejects that file because it doesn't know the type. This PR adds a credentials::external_account_authorized_user module, modeled on user_account, and wires it into ADC.

Behavior, matching the Node.js ExternalAccountAuthorizedUserClient:

• Access tokens are refreshed by POSTing grant_type=refresh_token&refresh_token=... (form-encoded) to token_url, with HTTP Basic client authentication (client_id:client_secret).
• If STS returns a rotated refresh_token, it is used for subsequent refreshes.
• If token_url is not set, it defaults to https://sts.{universe_domain}/v1/oauthtoken.
• token_type defaults to Bearer when STS omits it.
• audience, token_info_url and revoke_url are accepted but not needed to refresh tokens.
• Building a signer from this type returns not_supported, the same as authorized_user.

Builder API: with_token_url, with_quota_project_id, with_universe_domain, retry/backoff/throttler, build() and build_access_token_credentials(). Scopes from the ADC builder are ignored, because the refresh grant doesn't take scopes. user_account handles universe domain the same way.

Tests: unit tests cover parsing, the request shape (Basic auth and form body), refresh-token rotation, caching, quota project, universe domain and default token URL, and retry vs. non-retry errors. There is also an ADC-level test that loads the file through GOOGLE_APPLICATION_CREDENTIALS. cargo test -p google-cloud-auth, cargo clippy --all-targets --all-features -D warnings and cargo fmt all pass locally.

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces support for Workforce Identity Federation user credentials (external_account_authorized_user) in the google-cloud-auth crate, including a new credentials module, builder, token provider, and unit tests. The feedback recommends optimizing the token provider by instantiating and reusing a single reqwest::Client instead of recreating it on every token refresh request, which prevents connection pooling and can lead to socket exhaustion under load.