Server-provided expires_in added to Instant without overflow check

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In several token providers, the server-provided `expires_in` seconds value is added directly to `Instant::now()` using standard addition:
- `src/auth/src/mds/client.rs:244`
- `src/auth/src/credentials/user_account.rs:494`
- `src/auth/src/credentials/external_account.rs:527`
- `src/auth/src/credentials/gdch.rs:209`

For example, in `user_account.rs`:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/user_account.rs#L492-L495

In Rust `std::time`, `Instant + Duration` panics if the resulting instant exceeds the platform's timer representation limit. Large or corrupted `expires_in` values from the server will crash the task rather than failing gracefully.

Start by inspecting the expires_in additions at src/auth/src/mds/client.rs:244, src/auth/src/credentials/user_account.rs:494, src/auth/src/credentials/external_account.rs:527, and src/auth/src/credentials/gdch.rs:209. Trace how each provider handles errors, then verify that an excessively large or corrupted server value fails gracefully rather than panicking.

Written by the indexing model from the issue text.