ADC project-id policy fails open and is not testable from consumers (round-3 follow-ups)

## Context

Non-blocking follow-ups raised in the round-3 review of #1 (merged) and echoed in the approval review of [plugin-ee-gcp#208](https://github.com/kestra-io/plugin-ee-gcp/pull/208#pullrequestreview-5218954761). None of them is tracked today — they only live in comments on closed PRs. The primary item (the ADC seam) is what prevents EE from writing a real behaviour test.

## Primary problem — the ADC hook fails open and is not testable

`GcpInterface.inferProjectIdFromApplicationDefault()` carries the policy for inferring `projectId` from Application Default Credentials:

- OSS (`plugin-gcp`): defaults to `true` → infers `projectId` from the ambient ADC key.
- EE (`plugin-ee-gcp`): overrides to `false` → refuses to silently adopt the host key file's `projectId`.

Two defects:

1. **Fails open.** The default is the *unsafe* behaviour (`true`). A new EE class that forgets to override the flag silently adopts the host key's `projectId` — exactly what the EE guard exists to prevent. Nothing catches the omission: no compile error, the method is hidden from the schema, and no test fails (flipping the default `true`→`false` leaves the suite green).
2. **Not testable from consumers.** ADC cannot be injected through the public `connection()` entry point. The EE test (`GcpInterfaceProjectIdTest.eeOptsOutOfApplicationDefaultInference`) can therefore only assert the *flag* (`inferProjectIdFromApplicationDefault() == false`), not the *behaviour* ("with ADC present and no `projectId`, EE does not adopt the project").

### Fix direction

- **Minimum**: invert the polarity — safe behaviour as the default, OSS opts in; plus assert the default directly and add an `AbstractTask` ADC case that does not override the flag.
- **Cleaner (the "seam")**: pass the ADC policy as an explicit argument to `connection()` instead of reading it off the interface. This gets edition policy off an interface that otherwise describes user-facing shape, **and** opens an injection point that lets EE write a real end-to-end behaviour test.

## Secondary follow-ups (same round-3 review)

- **`projectId` semantics under impersonation.** Since the extraction, resolution runs against the *source* credentials (pre-impersonation), so `projectId` becomes the JSON key's project. Impersonation is normally used to cross projects, and `AbstractGcs.connection()` then calls `.setProjectId(...)`: a loud failure was replaced by a silent wrong-project guess, and the impersonated account email (which encodes the intended project) is ignored. Make it a documented decision: either keep failing, or derive from the impersonated account.
- **Impersonation scopes are untested.** Replacing the scopes with an empty list leaves the suite green (`shouldWrapCredentialsWithImpersonationWhenRequested` only asserts `getAccount()`). In production this regresses to 403s. Assert the scopes on the returned `ImpersonatedCredentials`.
- **Published Gradle module metadata: hard pin.** `runtimeElements` exports `io.kestra:platform` `strictly 1.3.19` (enforced-platform), from `implementation enforcedPlatform(...)`. A Gradle consumer on a different `kestraVersion` gets a resolution failure, not a soft override. Separately, `apiElements` publishes `google-auth-library-oauth2-http` with no version key. This works today only because both consumers import the platform themselves.

## References

- Round-3 review (#1): https://github.com/kestra-io/plugin-gcp-lib/pull/1#pullrequestreview-5218954464
- Approval review (#208): https://github.com/kestra-io/plugin-ee-gcp/pull/208#pullrequestreview-5218954761

Start with GcpInterface.inferProjectIdFromApplicationDefault(), the connection() entry point, and AbstractTask; compare the OSS default with the EE override and read GcpInterfaceProjectIdTest.eeOptsOutOfApplicationDefaultInference. Add coverage for ADC behaviour and impersonation scopes, then verify the documented projectId decision. Inspect runtimeElements and apiElements metadata to confirm platform and oauth2-http versions are published safely.

Written by the indexing model from the issue text.