feat(auth): Add support for Regional Access Boundaries

[vverman]

The Regional Access Boundaries PR to main. Contains all the changes merged to the feature branch "regional-access-boundaries" rebased on top of main.

[gemini-code-assist]

Code Review

This pull request introduces support for Regional Access Boundaries (RAB) by adding RegionalAccessBoundary, RegionalAccessBoundaryManager, and RegionalAccessBoundaryProvider to manage, cache, and asynchronously refresh allowed locations. This functionality is integrated across various credential classes to attach the x-allowed-locations header to outgoing requests. Feedback on the changes suggests catching IllegalStateException in RegionalAccessBoundaryManager to permanently skip RAB lookups on configuration errors and avoiding a redundant HashMap copy in GoogleCredentials.getAdditionalHeaders().

[gemini-code-assist]

If getRegionalAccessBoundaryUrl() throws an IllegalStateException due to a permanent configuration error (such as an invalid or null audience), catching it as a general exception and triggering a cooldown retry is inefficient because the configuration will never become valid. Catching IllegalStateException specifically to log a warning and set skipRAB to true prevents futile background retries.

            } catch (IllegalStateException e) {
              log(
                  LOGGER_PROVIDER,
                  Level.WARNING,
                  null,
                  "Permanent configuration error detected. Skipping future Regional Access Boundary refreshes: "
                      + e.getMessage());
              skipRAB.set(true);
            } catch (Exception e) {
              handleRefreshFailure(e);

[gemini-code-assist]

Creating a new HashMap copy of super.getAdditionalHeaders() is redundant because addQuotaProjectIdToRequestMetadata does not modify the passed map directly; instead, it returns a new ImmutableMap if modifications are needed. We can pass the original map directly to avoid unnecessary object allocation.

Suggested change

	Map<String, List<String>> headers = new HashMap<>(super.getAdditionalHeaders());
	Map<String, List<String>> headers = super.getAdditionalHeaders();