feat(identity): authenticate requests with Google Application Credentials

[evgheni7]

Description of your changes

Adds an optional spec.identity to ProviderConfig/ClusterProviderConfig so the provider can obtain an OAuth2 bearer token itself, starting with Google Application Credentials. Today a short-lived token has to be kept fresh in a Secret by something outside Crossplane. A service account key can't be used directly, since turning one into a token means signing a JWT assertion.

spec:
  credentials:
    source: None
  identity:
    type: GoogleApplicationCredentials
    source: Secret
    secretRef:
      name: gcp-credentials
      namespace: crossplane-system
      key: credentials.json

source: InjectedIdentity resolves from the pod's environment instead (Workload Identity on GKE). Optional scopes narrows from the default cloud-platform.

The API shape and token handling both follow provider-kubernetes, using spec.identity with an IdentityType and the logic in pkg/kube/client/gke, so the two providers are configured the same way. spec.identity is optional and a request carrying its own Authorization header keeps it, so existing behaviour is unchanged.

IdentityType declares only GoogleApplicationCredentials rather than enum values with nothing behind them. The Azure/AWS/Nebius variants can follow the same shape if preferred.

Related to crossplane-contrib#142, though that asks for a different mechanism (mounted token files).

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

Unit tests for the token source covering both credential formats, the injected-identity path, and the error cases. Existing suite passes unchanged.