gcp_authn: fix bound token requests

[antoniovleonti]

Commit Message: gcp_authn: fix bound token requests
Additional Description:

The gcp_authn filter was passing along the fingerprint incorrectly in bound token requests:

• The fingerprint query parameter key should be bindCertificateFingerprint.
• The fingerprint query parameter value should be base-64 encoded, then double url encoded.

This is exactly how the official Google python auth library structures its requests for bound tokens.

Risk Level: low
Testing: tests updated
Docs Changes: none
Release Notes: none

[tyxia]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the GCP authentication client to use the bindCertificateFingerprint query parameter instead of client_certificate_sha256, and double URL-encodes the fingerprint value to meet the GCP metadata server's requirements. Corresponding unit and integration tests have been updated to reflect these changes. The reviewer suggests adding explanatory comments to the double URL-encoding logic to prevent future maintainers from mistakenly simplifying it.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[tyxia]

Thank you!