[WIP] fix(auth): set default max_metadata_size to 32KB in gRPC channels

[ohmayr]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

[gemini-code-assist]

Code Review

This pull request configures a default grpc.max_metadata_size of 32 KB (32768 bytes) in secure_authorized_channel to prevent metadata limit rejections when using Post-Quantum Cryptography (PQC) bearer tokens or large trace headers. It also adds a unit test to verify this behavior when no options are explicitly provided. The reviewer recommended expanding the unit tests to cover scenarios where options are explicitly passed, both with and without grpc.max_metadata_size already specified, to ensure complete test coverage of the new logic.

[gemini-code-assist]

The current test only verifies the case where options is not provided. To ensure full coverage and robust behavior, we should also test when options is explicitly passed (both with and without grpc.max_metadata_size already set).

    def test_secure_authorized_channel_pqc_max_metadata_size(
        self,
        secure_channel,
        ssl_channel_credentials,
        metadata_call_credentials,
        composite_channel_credentials,
        get_client_ssl_credentials,
    ):
        credentials = mock.Mock()
        request = mock.Mock()
        target = "example.com:80"
        ssl_credentials = mock.Mock()

        # Call without explicit options; should automatically add grpc.max_metadata_size=32768
        google.auth.transport.grpc.secure_authorized_channel(
            credentials, request, target, ssl_credentials=ssl_credentials
        )

        _, kwargs = secure_channel.call_args
        assert "options" in kwargs
        assert ("grpc.max_metadata_size", 32768) in kwargs["options"]

        # Call with explicit options not containing grpc.max_metadata_size
        google.auth.transport.grpc.secure_authorized_channel(
            credentials,
            request,
            target,
            ssl_credentials=ssl_credentials,
            options=[("some_option", 1)],
        )
        _, kwargs = secure_channel.call_args
        assert ("some_option", 1) in kwargs["options"]
        assert ("grpc.max_metadata_size", 32768) in kwargs["options"]

        # Call with explicit options already containing grpc.max_metadata_size
        google.auth.transport.grpc.secure_authorized_channel(
            credentials,
            request,
            target,
            ssl_credentials=ssl_credentials,
            options=[("grpc.max_metadata_size", 1024)],
        )
        _, kwargs = secure_channel.call_args
        assert ("grpc.max_metadata_size", 1024) in kwargs["options"]
        assert ("grpc.max_metadata_size", 32768) not in kwargs["options"]