[Hashicorp] Fix Vault GCP auth for GCE metadata credentials

[fpopic]

What

Fix HashiCorp Vault GCP authentication when Application Default Credentials come from Compute Engine metadata credentials and initially expose the service account email as default.

Why

In GCE-based environments such as Cloud Composer, google.auth.compute_engine.Credentials may start with service_account_email == "default" until the credentials are refreshed from the metadata server. The Vault client used that value directly in the IAM signJwt request, producing an invalid resource name like projects/<project>/serviceAccounts/default.

Sanitized task log excerpt:

{connection.py:531} ERROR - Unable to retrieve connection from secrets backend (VaultBackend). Checking subsequent secrets backend.
googleapiclient.errors.HttpError: <HttpError 400 when requesting https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/default:signJwt?alt=json returned "Invalid form of account ID default. Should be [Gaia ID |Email |Unique ID |] of the account". Details: "Invalid form of account ID default. Should be [Gaia ID |Email |Unique ID |] of the account">
airflow.exceptions.AirflowNotFoundException: The conn_id `<conn-id>` isn't defined

Context

• Observed while testing apache-airflow-providers-hashicorp==4.7.0rc1 from PyPI: https://pypi.org/project/apache-airflow-providers-hashicorp/4.7.0rc1/
• Follow-up fix for the ADC support added in [Hashicorp] Enable ADC for Vault GCP authentication #53801.
• Provider testing context: Status of testing Providers that were prepared on June 02, 2026 #67957 for rc1 wave

How

• Resolve GCP service account email before building the IAM signJwt request.
• Treat missing or default service account email values as unresolved.
• Refresh Compute Engine credentials so the metadata server populates the real service account email.
• Preserve key-file behavior by using client_email when available.
• Add a regression test for the Compute Engine/Composer ADC case.

Tests

.venv/bin/python -m pytest providers/hashicorp/tests/unit/hashicorp/_internal_client/test_vault_client.py -q --with-db-init

AI assistance

This PR was prepared with help from GPT-5 / Codex.

[fpopic]

@potiuk it is ready for review, once released as rc2 will do a real intergration test in our enterprise environment.