feat(oauth2): support non-mTLS token URLs and unbound actor tokens in IdentityPoolCredentials

[macastelaz]

Summary

Allows actor_token and actor_token_type to be used in IdentityPoolCredentials with standard (non-mTLS) STS and IAM impersonation endpoints and without requiring client certificate (certificate_config) configuration.

Context & Rationale

In #13955, client-side guardrails (isMtlsConfigured() and validateMtlsEndpoint()) were enforced in the IdentityPoolCredentials constructor because Google STS initially required actor tokens to be paired with certificate-bound tokens over mTLS. Per the original design discussion, this was intentionally designed as a one-way door that could be loosened in a non-breaking manner once backend support for non-mTLS actor token exchanges was ready.

Changes

1. Removed Constructor mTLS Restrictions:
   • Removed isMtlsConfigured() check in IdentityPoolCredentials(Builder) so actor tokens can be configured with standard HttpTransportFactory instances and without a certificate block.
   • Removed validateMtlsEndpoint() checks on tokenUrl and serviceAccountImpersonationUrl, allowing standard public endpoints (e.g., https://sts.googleapis.com/v1/token) to be used with actor tokens.
   • Preserved strict pairing validation between actorTokenSupplier and actorTokenType, as well as JSON format checks for file-based actor token extraction.
2. 401 Handling & Cert Rotation:
   • When x509Provider == null (non-mTLS credentials), refreshAccessToken() uses standard transport without snapshotting a KeyStore, and 401 Unauthorized errors propagate immediately without retry.
   • When x509Provider != null && transportFactory instanceof MtlsHttpTransportFactory (mTLS credentials), per-cycle certificate pinning and single-retry cert reload on 401 remain unchanged.
3. Javadoc & Test Coverage:
   • Updated class-level and builder Javadocs on IdentityPoolCredentials.
   • Updated negative constructor tests to positive verification tests (*_succeeds).
   • Added refreshAccessToken_401WithActorTokenAndNonMtlsTransport_bubblesUpWithoutRetry and fromStream_fileCredentialSource_withoutCertificateConfig_andActorToken_withNonMtlsUrl_refreshesSuccessfully to verify end-to-end non-mTLS actor token exchanges.

Verification

• All 1,035 unit tests passing in oauth2_http module (including all 88 tests in IdentityPoolCredentialsTest).
• 100% compliant with fmt-maven-plugin:2.25:check.

[gemini-code-assist]

Code Review

This pull request removes the restriction requiring mTLS endpoints and transport configuration for actor token exchanges in IdentityPoolCredentials. Validation checks enforcing mTLS are removed, and unit tests are updated to verify that configuring actor tokens without mTLS now succeeds. Feedback is provided regarding a cross-platform issue in a new test where unescaped backslashes in a file path can cause JSON parsing failures on Windows.