Sends malformed request to https://android.googleapis.com/auth/devicekey breaking Google Translate (and likely others)

Was working; broke a few months ago. adb logcat shows that MicroG is sending a "malformed request" to Google:

11-22 10:22:23.879 10895 17148 D GmsHttpFormClient: device=<REDACTED>&app=com.google.android.gms&cert=<REDACTED>&app_ver=223616050&X-subscription=<REDACTED>&X-X-subscription=<REDACTED>&X-subtype=<REDACTED>&X-X-subtype=<REDACTED>&X-scope=DeviceKeyRequest&X-app_ver_name=0.2.25.223616&target_ver=29&sender=<REDACTED>
--------- beginning of system
11-22 10:22:23.887  1371 18211 W NotificationService: notification 0|de.blinkt.openvpn|1346787898|null|10175 added an invalid shortcut
11-22 10:22:23.888  1371  1758 W NotificationService: notification 0|de.blinkt.openvpn|1346787898|null|10175 added an invalid shortcut
11-22 10:22:23.913  1040 16882 E sensors-hal: handle_sns_std_sensor_event:281, wise_light: lux 456 ,period 35 ms, data c 0
11-22 10:22:23.934 10895 17148 D GmsHttpFormClient: -- Response --
11-22 10:22:23.934 10895 17148 D GmsHttpFormClient: token=<REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: Request: DeviceKeyRequest{droidGuardResult=<REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: <base64, REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: <base64, REDACTED>
[.. etc ..]
11-22 10:22:23.951 10895  3803 D AppCertManager: <base64, REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: <base64, REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: onId=<REDACTED>, versionInfo=VersionInfo{sdkVersion=32, gmsVersion=223616050}, token=<REDACTED>
11-22 10:22:23.951 10895  3803 D AppCertManager: <base64, REDACTED>}
11-22 10:22:24.040 10895 17145 E Volley  : [376] NetworkUtility.shouldRetryException: Unexpected response code 400 for https://android.googleapis.com/auth/devicekey
11-22 10:22:24.041 10895 10895 D AppCertManager: Error: [..
webpage in base64, includes:
<main id="af-error-container" role="main"><a href=//www.google.com><span id=logo aria-label=Google role=img></span></a><p><b>400.</b> <ins>That’s an error.</ins><p>The server cannot process the request because it is malformed. It should not be retried. <ins>That’s all we know.</ins></main>
.. ]
11-22 10:22:24.041 10895  3803 D AppCertManager: Using fallback spatula header based on Android ID
11-22 10:22:24.041 10895  3803 D AppCertManager: Spatula Header: SpatulaHeaderProto{packageInfo=PackageInfo{packageName=com.google.android.apps.translate, packageCertificateHash=JLskwF5H4K76aKWKdmF52bYTpgA=}, deviceId=<REDACTED>}
11-22 10:22:24.042 10895 10895 D AuthProxyService: Result: <REDACTED>
11-22 10:22:24.043 17009 17114 D OkHttp  : --> GET https://translate-pa.googleapis.com/v1/translate?<REDACTED>
11-22 10:22:24.087 17009 17114 D OkHttp  : <-- 400 Bad Request https://translate-pa.googleapis.com/v1/translate?<REDACTED> (43ms, unknown-length body)
11-22 10:22:24.088 17009 17114 E GTR_jpj : Translation response error
11-22 10:22:24.088 17009 17114 E GTR_jpj : retrofit2.HttpException: HTTP 400 Bad Request
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at retrofit2.KotlinExtensions$await$2$2.onResponse(PG:11)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at retrofit2.OkHttpCall$1.onResponse(PG:4)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at rkb.b(PG:4)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at rkq.run(PG:3)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
11-22 10:22:24.088 17009 17114 E GTR_jpj : 	at java.lang.Thread.run(Thread.java:920)

Part of the request includes MicroG's own internal version number, maybe that's what's breaking things.

Work-around is to (1) download offline translation file then (2) firewall block Google Translate from making any internet requests, thereby tricking it into using offline translation.

Start by tracing the DeviceKeyRequest through AppCertManager and GmsHttpFormClient, using the adb logcat request to the auth/devicekey endpoint as the reproduction evidence. Compare the generated request with the 400 response and verify the resulting authentication flow by checking whether Google Translate requests no longer fail.