Currently, `google.auth.default()` always attempts to authenticate using
the Google Compute Engine (GCE) metadata service as a fallback. There is
no easy way to prevent this behavior, leading to unnecessary delays and
unhelpful exceptions, particularly in cases where GCE-based
authentication is pointless or undesired.

This pull request introduces a `NO_GCE_CHECK` environment variable,
allowing users to explicitly skip GCE metadata service authentication.
This implementation mirrors `NO_GCE_CHECK` in
[googleapis/google-auth-library-java](https://github.com/googleapis/google-auth-library-java/blob/f154edb3d8503d29f0020b6904dfa40e034ded93/README.md?plain=1#L106-L119):

> _The following are searched (in order) to find the Application Default
Credentials:_
>
> [...]
>
> 5. Google Compute Engine built-in credentials
> - Skip this check by setting the environment variable
`NO_GCE_CHECK=true`

> [!NOTE]
> Other clouds also provide similar environment variables, such as
`AWS_EC2_METADATA_DISABLED` on AWS.

This change is also tangentially related to the following pull requests:
- #1488
- #1481

---------

Co-authored-by: Anthonios Partheniou <partheniou@google.com>
Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

PR created by the Librarian CLI to initialize a release. Merging this PR
will auto trigger a release.

Librarian Version: v1.0.1
Language Image:
us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:b8058df4c45e9a6e07f6b4d65b458d0d059241dd34c814f151c8bf6b89211209
<details><summary>google-auth: 2.48.0</summary>

##
[2.48.0](v2.47.0...v2.48.0)
(2026-01-21)

### Features

* honor `NO_GCE_CHECK` environment variable (#1610)
([383c982](383c9827))

* add configurable GCE Metadata Server retries (#1488)
([454b441](454b441b))

* add cryptography as required dependency (#1929)
([52558ae](52558ae2))

* Support the mTLS IAM domain for Certificate based Access (#1938)
([8dcf91a](8dcf91a1))

### Bug Fixes

* resolve circular imports (#1942)
([25c1b06](25c1b064))

* Use `user_verification=preferred` for ReAuth WebAuthn challenge
(#1798)
([3f88a24](3f88a240))

* removes `content-header` from AWS IMDS get request (#1934)
([97bfea9](97bfea9e))

* detect correct auth when ADC env var is set but empty (#1374)
([bfc07e1](bfc07e10))

* replace deprecated utcfromtimestamp (#1799)
([e431f20](e431f20c))

</details>