Add comment to explain why padding is removed.

Change-Id: I0882e0c5d99310b179ace493b937669520626263

Author: huangjiahua

cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java

@@ -206,6 +206,8 @@ public AccessToken generateToken(CredentialAccessBoundary accessBoundary)
 
     byte[] encryptedRestrictions = this.encryptRestrictions(rawRestrictions, sessionKey);
 
+    // withoutPadding() is used to stay consistent with server-side CAB
+    // withoutPadding() avoids additional URL encoded token issues (i.e. extra equal signs `=` in the path)
     String tokenValue =
         intermediateToken + "." + Base64.getUrlEncoder().withoutPadding().encodeToString(encryptedRestrictions);