ProgrammaticBuilder::with_target_principal hardcodes googleapis.com ignoring universe_domain

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/auth/src/credentials/external_account.rs`, `ProgrammaticBuilder::with_target_principal` formats the service account impersonation URL:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/external_account.rs#L1263-L1268

The URL hardcodes `https://iamcredentials.googleapis.com/...`. When a custom universe domain is configured via `with_universe_domain`, the STS token URL is updated to use the custom domain, but the impersonation URL retains the hardcoded `googleapis.com` endpoint.

Start in src/auth/src/credentials/external_account.rs at ProgrammaticBuilder::with_target_principal, especially lines 1263-1268, and compare its impersonation URL with the STS token URL handling in with_universe_domain. Verify the behavior with a custom universe domain; done means the impersonation endpoint uses that configured domain instead of hardcoding googleapis.com.

Written by the indexing model from the issue text.