Missing exp claim panics and expired tokens get future expiration via abs_diff

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/auth/src/credentials/idtoken.rs`, ID token expiration is extracted from JWT claims:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/idtoken.rs#L317-L319

Direct indexing `claims["exp"]` panics if the `"exp"` claim is missing from the claims map.

Additionally, `instant_from_epoch_seconds` computes expiration using `abs_diff`:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/idtoken.rs#L329-L333

If the token's expiration is in the past (e.g. `exp = now - 3600s`), `abs_diff` produces `3600s`. Adding this duration to `Instant::now()` sets `expires_at` to 1 hour in the future, treating expired tokens as valid.

Start in src/auth/src/credentials/idtoken.rs at the ID-token claim extraction around lines 317-319 and instant_from_epoch_seconds around lines 329-333. Verify behavior for a missing exp claim and an expiration one hour in the past, then inspect nearby tests or add focused coverage. Done means missing claims no longer panic and expired tokens are not represented as expiring in the future.

Written by the indexing model from the issue text.