ID token verifier hardcodes issuer to accounts.google.com, rejecting IAP tokens

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/auth/src/credentials/idtoken/verifier.rs`, the expected token issuer is hardcoded:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/idtoken/verifier.rs#L174-L178

```rust
// TODO(#3591): Support TPC/REP that can have different issuers
validation.set_issuer(&["https://accounts.google.com", "accounts.google.com"]);
```

However, `JwkClient` specifically supports ES256 keys by fetching from the Cloud IAP JWKS URL (`https://www.gstatic.com/iap/verify/public_key-jwk`):

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/internal/jwk_client.rs#L88-L90

Google Cloud Identity-Aware Proxy (IAP) tokens use ES256 signatures with issuer `https://cloud.google.com/iap`. Because the verifier only accepts `accounts.google.com`, all authentic IAP tokens fail verification with `InvalidIssuer`.

Start in src/auth/src/credentials/idtoken/verifier.rs around the issuer validation and compare it with the ES256 and JWKS handling in src/auth/src/credentials/internal/jwk_client.rs. Confirm the issuer used by Cloud IAP tokens and trace the existing verification path; done means authentic IAP tokens using the documented JWKS source no longer fail with InvalidIssuer without breaking existing issuer validation.

Written by the indexing model from the issue text.