feat(google): accept pre-minted access tokens for service-account impersonation / OIDC

[jorgegmz]

Summary

Adds a pre-minted access-token path to the GCP authentication flow so callers that already hold a valid Google Cloud OAuth2 access token can bypass the JWT-from-private-key exchange and inject the token directly.

Mirrors the existing pattern added for Azure in # (feat(azure): accept pre-minted access tokens for federated identity / OIDC).

Why

There are several legitimate scenarios where a caller has a valid Google Cloud access token but no service-account JSON key:

• Service-account impersonation via iamcredentials.generateAccessToken — the orchestrator holds an executor SA and mints short-lived tokens against target SAs.
• Workload-identity federation — federated identity exchanges return access tokens, never private keys.
• OIDC flows — same as above, no client_secret available.

Today these callers must either embed a long-lived private key (defeating the purpose of impersonation/federation) or fork/vendor patches against CloudSploit.

What changed

• helpers/google/index.js authenticate(): when GoogleConfig.access_token is present, return an OAuth2Client with the token set directly via setCredentials({ access_token }). The returned client exposes the same
  .request() surface that plugins consume — no plugin changes required.
• index.js: new else if branch detecting config.credentials.google.access_token and configuring cloudConfig with { type, project, access_token }. Placed ahead of the existing client_email + private_key branch so the
  pre-minted path takes precedence when a token is supplied. project is still required so plugins can address the correct GCP project.

Test plan

• Existing direct-SA path (client_email + private_key) continues to work unchanged.
• New access_token path authenticates plugin API calls successfully.
• Omitting project produces a clear "missing required key" error.
• credential_file path remains unaffected (it's still evaluated first).

[jorgegmz]

Hi @alphadev4,

Friendly ping for review when time permits. This PR adds support for GCP service-account impersonation, workload identity federation, and OIDC-based authentication by allowing callers to provide a pre-minted Google Cloud access token instead of a service-account private key.

The change is fully backward compatible with the existing authentication paths and requires no plugin changes. I'd appreciate any feedback when you have a chance.

Thank you.