Malformed identity JWT encoding raises instead of expiring the cached token

## Summary

`ComputeMetadata#determine_identity_lifetime` rescues malformed JSON, but not malformed URL-safe Base64 in the JWT payload. A metadata response containing an invalid encoded payload therefore raises `ArgumentError` while deciding its cache lifetime instead of treating the token as immediately expired.

## Reproduction

On current `main` (`7936c72eb2c809214858f47473aafb04c6bbf469`), calling the private lifetime calculation with an identity path and a token whose middle segment is invalid URL-safe Base64 raises `ArgumentError` from `Base64.urlsafe_decode64`.

## Proposed correction

Handle `ArgumentError` alongside the existing malformed-JSON behavior and return a zero lifetime. I verified the two-line rescue against malformed padding/characters, the full current suite (91 runs / 419 assertions / 0 failures / 0 errors / 2 skips), and the normal valid-token lifetime path.

I used an AI coding assistant during investigation and verification. I am opening this issue first because this repository requires tests and a Google CLA for pull requests; I have not modified repository tests or signed a CLA as part of this audit.

Start with ComputeMetadata#determine_identity_lifetime and reproduce the invalid URL-safe Base64 case described in the issue. Check the existing malformed-JSON handling and verify that malformed JWT payloads produce a zero lifetime without changing the valid-token lifetime path. Confirm the relevant test suite still passes.

Written by the indexing model from the issue text.