fix(gax): use TLS channel credentials for DirectPath over Interconnect - #14864

InstantiatingGrpcChannelProvider wrapped DirectPath over Interconnect
channels in GoogleDefaultChannelCredentials, whose negotiator selects
ALTS for every xDS cluster not prefixed "google_cfe_". The regional
Interconnect clusters that RLS returns for data operations are not CFE
clusters, and ALTS is unavailable outside Google Cloud, so those
connections fail once the service routes to them.

The provider now builds CompositeChannelCredentials from
TlsChannelCredentials and the call credentials when Interconnect is
active, so every subchannel negotiates TLS. The call credentials stay on
the channel credentials because those are the only credentials the RLS
control channel inherits from the parent channel. ALTS hard-bound tokens
are not requested on this path; they need an ALTS connection. Standard
DirectPath is unchanged.

DirectPath over Interconnect also requires credentials now, as standard
DirectPath does. Previously a channel built with NoCredentialsProvider
still used DirectPath, and GoogleDefaultChannelCredentials loaded
Application Default Credentials on its own, or failed every RPC with
UNAUTHENTICATED when none were available. Such a channel now falls
back to CloudPath.

The misconfiguration log covers Interconnect as well. It names the
missing credentials instead of asking for ComputeEngineCredentials, it
reports Interconnect being enabled without the attemptDirectPath
option (or with GOOGLE_CLOUD_DISABLE_DIRECT_PATH set), as it already
did for the xDS option, and it logs Interconnect misconfigurations at
WARNING off GCE, where Interconnect is meant to run, when the client
asked for Interconnect through the builder option. The
GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS_OVER_INTERCONNECT environment
variable is process-wide, so a client that did not enable DirectPath
treats it like GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS: a note that it may
be a misconfiguration, at WARNING on GCE and FINE elsewhere. Standard
DirectPath keeps logging at FINE off GCE.

The credential selection moves into
createDirectPathChannelCredentials so it can be tested without
dialing. Tests cover the builder option, the environment variable
(including case and whitespace), invalid and "false" values, null
credentials with and without an mTLS client certificate provider, ALTS
hard-bound tokens on both paths, the credentials the channel builder
receives, and the new log messages and levels. In java-storage,
StorageOptionsBuilderTest now attaches the client's credentials before
expecting DirectPath over Interconnect, and checks that NoCredentials
falls back to CloudPath.