Empty canonical URI generated for bucket-level signed URLs with VirtualHostedStyle or BucketBoundHostname

Unconfirmed. This is the result of a search with Gemini, may be a false positive.

When generating a signed URL for a bucket using `SignedUrlBuilder::for_bucket(...)` with `UrlStyle::VirtualHostedStyle` or `UrlStyle::BucketBoundHostname`, `canonical_uri` returns an empty string `""`:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/signed_url.rs#L198-L205

This empty canonical URI is then joined into the canonical request:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/signed_url.rs#L571-L580

This produces `GET\n\n\n...` instead of `GET\n/\n\n...`.

However, under [Cloud Storage's canonical-request specification](https://docs.cloud.google.com/storage/docs/authentication/canonical-requests):
> Canonical URI: The path portion of the URI (everything between the HTTP method and the query string). If the path is empty, use a single forward slash (`/`).

Furthermore, under [RFC 9112 §3.2.1](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2.1), any HTTP client (browser, curl, reqwest) making an HTTP request to `https://.storage.googleapis.com?...` will format the request-target with an origin path of `/` (`GET /?... HTTP/1.1`). Consequently, the signed path differs from the requested path, causing server-side signature validation to fail with `403 Forbidden` (`SignatureDoesNotMatch`).

Lines 202–203 in `canonical_uri` should return `"/"` instead of `""`.

Start in src/storage/src/storage/signed_url.rs at SignedUrlBuilder::for_bucket and canonical_uri around lines 198–205, then inspect canonical request assembly around lines 571–580. Verify the VirtualHostedStyle and BucketBoundHostname cases use `/` as the canonical URI, so the generated request target and signature match Cloud Storage's specification.

Written by the indexing model from the issue text.