fix(auth): avoid redundant executable run and preserve impersonated email in PluggableAuthCredentials

[lsirac]

Summary

Fixes two issues in PluggableAuthCredentials when service account impersonation is configured:

1. refreshAccessToken() now checks getServiceAccountImpersonationUrl() != null and delegates directly to impersonatedCredentials.refreshAccessToken(), instead of running the executable a first time on the outer credential and discarding the token.
2. PluggableAuthCredentials.Builder(PluggableAuthCredentials) captures getServiceAccountEmail() before buildImpersonatedCredentials() clears serviceAccountImpersonationUrl on sourceCredentials, so GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL is still passed to the executable.

Testing

• Unit tests: PluggableAuthCredentialsTest and ExternalAccountCredentialsTest
• Live manual testing against STS, IAMCredentials, TokenInfo, and Pub/Sub: https://paste.googleplex.com/5773206833725440

[gemini-code-assist]

Code Review

This pull request updates ExternalAccountCredentials and PluggableAuthCredentials to properly handle and preserve the impersonated service account email when cloning or creating scoped credentials. It introduces a lazy initializer getImpersonatedCredentials() in ExternalAccountCredentials, adds the impersonatedServiceAccountEmail field and builder methods to PluggableAuthCredentials, and overrides getServiceAccountEmail() to fall back to this email. Additionally, corresponding unit tests have been updated and added to verify that the impersonated email is correctly set in the environment and preserved during scoping. There are no review comments to address, and I have no additional feedback to provide.