Support GCS vended credentials in Iceberg REST catalog

[kaveti]

Description

The Iceberg REST catalog spec allows the catalog server to return
file IO properties in the load-table response. These properties can
include cloud-specific credentials and configuration that override
the connector's static settings on a per-table basis as "vended credentials."

Trino already supports vended S3 credentials (access key, secret key,
session token), but GCS properties from the REST catalog response are
currently ignored. This means users connecting to a REST catalog that
vends GCS credentials (e.g., Tabular, Polaris, or custom catalog
implementations) cannot use those credentials for GCS-backed tables.

For example, a REST catalog server managing tables across multiple GCP
projects might vend different gcs.project-id and gcs.oauth2.token
values per table. Without this change, Trino would always use the
statically configured credentials, which may not have access to all
tables.

This change adds support for the following Iceberg GCP properties
from vended credentials:

• gcs.oauth2.token / gcs.oauth2.token-expires-at — OAuth2 access token
• gcs.project-id — GCP project ID
• gcs.service.host — custom storage endpoint
• gcs.no-auth — skip authentication (e.g., public buckets)
• gcs.user-project — requester-pays billing project
• gcs.encryption-key / gcs.decryption-key — client-side encryption keys

These properties are extracted from fileIoProperties in
[IcebergRestCatalogFileSystemFactory] and passed through
ConnectorIdentity extra credentials to the GCS filesystem layer:

• [GcsStorageFactory] applies no-auth (via NoCredentials) and
  user-project (via setQuotaProjectId) on the StorageOptions
  builder. no-auth takes priority over an OAuth token when both
  are present.
• [GcsFileSystemFactory] extracts encryption/decryption keys and
  passes them as defaults to [GcsFileSystem], which applies them
  to [newInputFile] and [newOutputFile] operations. Explicit
  encryption keys provided via [newEncryptedInputFile] /
  [newEncryptedOutputFile] still take precedence.

Additional context and related issues

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

## Section
* Fix some things. ({issue}`24518 `)

Fixes #24518

[findinpath]

Thank you for your contribution - please focus on adding integration tests for the functionality.

[kaveti]

thank you reviewing the PR. @findinpath i have addressed all your review comments. could you please take a look again.

[kekwan]

Much needed PR for GCS. Thanks @kaveti. PR LGTM, looks in-line with S3 implementation.

[kaveti]

@findinpath could you please review again. i have addressed your review comments.