GCP Integration Blocks: Support Workload Identity / ADC

/GCP/PubSub/V1/Projects/Topics/Publish Topics) cannot be used when Concert Workflows runs on Google Kubernetes Engine (GKE) with Workload Identity, which is Google's recommended authentication model and the only model permitted under our security policy (no long-lived service account keys).The block requires a stored Concert authentication (authKey) and I would assume other blocks need the same. With authKey empty, the run fails immediately with: "authKey not provided." and with authKey set to a GCP authentication, the block always executes its own OAuth client flow using the stored credentials. With anything other than a real static credential this fails with: GCP authentication failed with: 401 {"error":"invalid_client","error_description":"The OAuth client was not found."} . The block schema exposes Google's standard oauth_token system parameter, but it is never honored because the authKey flow runs (and fails) first.

Requested enhancement (in order of preference)

1. Add a GCP authentication type "Workload Identity / Application Default Credentials": the block obtains its token at runtime from the standard ADC chain (metadata server on GKE/GCE), storing no secret.
2. Alternatively : make authKey optional and honor the oauth_token (or an explicit bearer token) parameter when supplied, skipping the stored-credential OAuth flow.