impl(oauth2): add methods for returning multiple auth related http headers

[scotthart]

This PR adds methods for retrieving the authorization and x-allowed-locations headers individually, as well as, the AuthenticationHeaders method as a single place to get all the auth related headers for RPC calls.

Similar changes for the gRPC auth path is being handled in the gRPC library.

[gemini-code-assist]

Code Review

This pull request refactors the credential authentication system to support multiple HTTP headers, replacing the single AuthenticationHeader with a vector-based AuthenticationHeaders method and adding specific logic for Authorization and AllowedLocations. A review comment suggests that errors from AllowedLocations should be handled more explicitly—either by logging or propagation—to avoid sending requests with missing headers that might cause ambiguous service failures.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.69%. Comparing base (fdbec33) to head (3388994).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16064      +/-   ##
==========================================
- Coverage   92.70%   92.69%   -0.01%     
==========================================
  Files        2343     2343              
  Lines      216644   216674      +30     
==========================================
+ Hits       200838   200850      +12     
- Misses      15806    15824      +18     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.