feat: add GCP Credential Access Boundary downscoping (#805)

## Summary

Add a typed Google Cloud Credential Access Boundary grant and
server-side STS granter to `reqsign-google`. It reuses the
`GrantCredential` / `Granter<Credential>` capability introduced in #803:
a token-only Google source credential authorizes the exchange, and the
result is an expiration-aware token-only `Credential` that the existing
Google signing path can consume.

The service API constructs Cloud Storage bucket and object-prefix rules
from validated types, emits the required list-prefix condition without
accepting raw CEL or STS JSON, enforces the documented CAB and
token-lifetime limits, and performs the exchange through
`Context::http_send`. Source and output deadlines are checked around
I/O, granted outputs are never cached, and credential material is
redacted from errors and `Debug`.

This is the second service implementation of scoped credential granting
after Azure while keeping authorization semantics within the Google
crate. The client-issued intermediary-token and session-key flow is
intentionally tracked separately in #804.

Live GCP STS and Cloud Storage acceptance remains pending because no
test credential and bucket were available for this implementation.

Closes #749.

Author: Xuanwo

reqsign/src/google.rs

@@ -19,6 +19,43 @@
 //!
 //! This module provides Google Cloud signing functionality along with convenience
 //! functions for common use cases.
+//!
+//! ## Credential Access Boundary downscoping
+//!
+//! A control plane can exchange a source OAuth access token for a token restricted
+//! to selected Cloud Storage buckets or object prefixes:
+//!
+//! ```no_run
+//! use std::time::Duration;
+//!
+//! use reqsign::{Context, Granter, time::Timestamp};
+//! use reqsign::google::{
+//!     CredentialAccessBoundaryGrant, CredentialAccessBoundaryGranter,
+//!     CredentialAccessBoundaryPermissions, TokenCredentialProvider,
+//! };
+//!
+//! # async fn example() -> reqsign_core::Result<()> {
+//! let source = TokenCredentialProvider::new("source-oauth-token")
+//!     .with_expires_at(Timestamp::now() + Duration::from_secs(3600));
+//! let grant = CredentialAccessBoundaryGrant::for_object_prefix(
+//!     "example-bucket",
+//!     "customer-a/",
+//!     CredentialAccessBoundaryPermissions::OBJECT_VIEWER,
+//! );
+//! // The context must be configured with an HttpSend implementation. When the
+//! // `default-context` feature is enabled, use `reqsign::default_context()`.
+//! let context = Context::new();
+//! let downscoped = Granter::new(
+//!     context,
+//!     source,
+//!     CredentialAccessBoundaryGranter::new(grant),
+//! )
+//! .grant(None)
+//! .await?;
+//! # let _ = downscoped;
+//! # Ok(())
+//! # }
+//! ```
 
 // Re-export all Google Cloud signing types
 pub use reqsign_google::*;

services/google/Cargo.toml

@@ -27,6 +27,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+bytes = { workspace = true }
 form_urlencoded = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
@@ -42,7 +43,6 @@ tokio = { workspace = true, features = ["time"] }
 reqsign-core = { workspace = true, features = ["jwt"] }
 
 [dev-dependencies]
-bytes = { workspace = true }
 dotenvy = { workspace = true }
 env_logger = { workspace = true }
 reqsign-file-read-tokio = { workspace = true }

services/google/src/constants.rs

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+use std::time::Duration;
+
 use percent_encoding::AsciiSet;
 use percent_encoding::NON_ALPHANUMERIC;
 
@@ -25,6 +27,8 @@ pub const GOOGLE_SCOPE: &str = "GOOGLE_SCOPE";
 // Default OAuth2 scope for Google Cloud services
 pub const DEFAULT_SCOPE: &str = "https://www.googleapis.com/auth/cloud-platform";
 
+pub(crate) const TOKEN_OPERATION_HEADROOM: Duration = Duration::from_secs(10);
+
 /// AsciiSet for [Google UriEncode](https://cloud.google.com/storage/docs/authentication/canonical-requests)
 ///
 /// - URI encode every byte except the unreserved characters: 'A'-'Z', 'a'-'z', '0'-'9', '-', '.', '_', and '~'.