Mixed-prefix GCS batch deletes reuse the first object's client for the whole batch

> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.
>
> Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.

# Summary

GCS batch deletes choose the client for the first object and reuse it
for the whole mixed-prefix batch, which can apply the wrong
credentials to other objects.

# Affected Maven coordinates

* primary shipped client artifact: `org.apache.iceberg:iceberg-gcp`
* bundle artifact: `org.apache.iceberg:iceberg-gcp-bundle`

# Attacker prerequisites

* control over a path, prefix, batch, or file list that sits adjacent
to a legitimately scoped prefix
* ability to trigger the credential-selection or cleanup path with
that crafted input

# Impact

* A single batch can contain objects that belong to different
credential prefixes.
* The credential chosen for the first object is then reused for every
other object in the batch.
* If that first credential is broader than the others, deletes can be
attempted against objects outside the intended prefix boundary.
* If it is narrower, deletes silently degrade into partial failure
because the GCS client is wrong for some of the objects.

# Proof status

Source review only. The issue is visible directly from source.

# Key source references

* org.apache.iceberg.gcp.gcs.GCSFileIO