[google-auth-library-java] General: The AWS V4 Signature implementation in AwsCredentials does not properly handle x-amz-content-sha256 header

#### Environment details

2. OS type and version: macOS 15.6
3. Java version: Corretto-21.0.7.6.1
4. version(s): Latest commit on default branch: 1669dc8

#### Steps to reproduce

1. Call AwsCredentials.retrieveSubjectToken() and inspect headers present in the resulting token.
2. Note that the x-amz-content-sha256 header is missing
3. Note that the official [AWS Signature Version 4 docs](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html) has the following to say about the `x-amz-content-sha256` header:

> The x-amz-content-sha256 header is required for all AWS Signature Version 4 requests. It provides a hash of the request payload. However, you are not required to include the x-amz-content-sha256 as a canonical header because S3 will automatically use its value when calculating the payload hash sent in the request.

> If there is no payload, you must provide the hash of an empty string.

> If you do not want S3 to check against the hash of the request, you can use the literal string "UNSIGNED-PAYLOAD" instead.

#### Code example

```diff
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java
index 7ba1d7d..cfeb038 100644
--- a/oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java
+++ b/oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java
@@ -304,6 +304,7 @@ public class AwsCredentialsTest extends BaseSerializationTest {
assertEquals("token", headers.get("x-amz-security-token"));
assertEquals(awsCredential.getAudience(), headers.get("x-goog-cloud-target-resource"));
assertTrue(headers.containsKey("x-amz-date"));
+ assertTrue(headers.containsKey("x-amz-content-sha256"));
assertNotNull(headers.get("Authorization"));

List requests = transportFactory.transport.getRequests();

```

#### External references such as API reference guides

https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html

#### Any additional information below

I am aware that Amazon is pretty slow moving when it comes to starting to fail requests with malformed signatures, but it is worth noting that the [Aws4Signer](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/auth/signer/Aws4Signer.html) that was missing the `x-amz-content-sha256` header is now deprecated, and it's replacement the `AwsV4HttpSigner` has no ability to generate signatures without the mentioned header. My understanding of your federated identity implementation is that for the mechanism to work, Amazon STS needs to accept your signature.

A first step towards addressing this might be to update the GCP STS service to accept the subjectToken parameters containing `x-amz-content-sha256`. Currently it fails with a 400 error and the confusing message `{"error":"invalid_grant","error_description":"The given AWS request doesn't contain all the required headers."}`.

从 AwsCredentials.retrieveSubjectToken 和 oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java 中的测试开始。重现缺失的 x-amz-content-sha256 标头，并检查生成的 subject token 如何被 GCP STS 接受。完成的标准是所需标头存在，且相关测试验证了这一点，同时不破坏 AWS 联合行为。

由索引模型根据 Issue 内容生成。