feat: implement agentic identities authentication via cert bound tokens.

[vverman]

This feature implements the ability for agentic identities to authenticate themselves via X509 cert bound tokens. We are limiting the scope here to only cloud run based agentic workloads.

[nbayati]

Overall a really good PR! Just a few small comments on the implementation. I'll review the unit tests next.

[nbayati]

nit: we can make this documentation more accurate by saying something along the lines of "Loads and parses the Agent Identity certificate if available and not opted out. "

[nbayati]

The current while (true) polling loop relies on checking the elapsed time in each iteration. While this works, a more deterministic and clearer approach would be to pre-calculates the number of fast and slow poll cycles and builds a list of sleep intervals. Then we can use a simple for loop to iterate through these fixed intervals.

This will not only make the code more readable, but it'd also be less error-prone and safer to maintain over the long term.

[nbayati]

Catching any exception and logging it at every loop iteration can make the logs noisy, instead you can use the warned flag to surface the user friendly warning here once.

We can also limit the catch to only the type of exceptions we are interested in, which would be the IOException thrown from extractCertPathFromConfig().