fix(auth): avoid redundant executable run and preserve impersonated email in PluggableAuthCredentials - #14446

Summary

Fixes two issues when PluggableAuthCredentials is configured with service account impersonation (service_account_impersonation_url):

1. Avoids redundant executable invocation: Previously, PluggableAuthCredentials.refreshAccessToken() unconditionally called retrieveSubjectToken() on the outer credential before delegating to exchangeExternalCredentialForAccessToken(...), which immediately delegated to impersonatedCredentials.refreshAccessToken() and discarded the outer subject token. refreshAccessToken() now checks getImpersonatedCredentials() upfront and delegates directly to impersonated.refreshAccessToken(), running the executable only once.
2. Preserves GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL on the inner source credential: ExternalAccountCredentials.buildImpersonatedCredentials() clones sourceCredentials with .setServiceAccountImpersonationUrl(null) to prevent infinite recursion, which previously caused getServiceAccountEmail() on sourceCredentials (and its scoped copy) to return null and omit GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL from the executable environment map. buildImpersonatedCredentials() now passes .setImpersonatedServiceAccountEmail(targetPrincipal) to the PluggableAuthCredentials builder, and PluggableAuthCredentials.getServiceAccountEmail() falls back to impersonatedServiceAccountEmail when super.getServiceAccountEmail() is null.

Testing

• Updated refreshAccessToken_withServiceAccountImpersonation and refreshAccessToken_withServiceAccountImpersonationOptions in PluggableAuthCredentialsTest to assert that the executable handler is invoked exactly once and receives GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL equal to credential.getServiceAccountEmail().
• Added createScoped_preservesImpersonatedServiceAccountEmail to verify preservation across createScoped() and reset when setServiceAccountImpersonationUrl(...) is called.