Update gaxios to 7.2.0 in gcp-metadata

gcp-metadata is pinning `gaxios@7.1.3`, which pulls in `rimraf`. That version of `rimraf` has a downstream dependency to `brace-expansion@2.1.x` with this flagged security vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-13149

Dependency tree:
```
│ └─┬ gcp-metadata@8.1.3
│ └─┬ gaxios@7.1.3
│ └─┬ rimraf@5.0.10
```

Start in the gcp-metadata package by locating the dependency declaration or lockfile entry that pins gaxios@7.1.3, then inspect the reported rimraf and brace-expansion dependency tree. Done means gaxios is updated to 7.2.0 and the dependency check no longer reports CVE-2026-13149.

Written by the indexing model from the issue text.