Adds the IAM Credentials REST emulator surface for local credential vending, including generateAccessToken validation, service enablement wiring, REST tests, and Java generated-client compatibility coverage.

- [x] New feature (`feat:`)

Implements the IAM Credentials v1 HTTP/JSON generateAccessToken path used by the Google Java IAM Credentials client. Verified with IamCredentialsServiceTest, IamCredentialsRestIntegrationTest, IamCredentialsDisabledRestIntegrationTest, IamServiceTest, and compatibility-tests/sdk-test-java IamCredentialsTest against a running emulator.

- [x] `./mvnw test` passes locally
- [x] New or updated integration test added
- [x] Commit messages follow Conventional Commits

Adds the STS token-exchange endpoint used by Google Java DownscopedCredentials, a deliberately limited GCS CAB parser, global Floci credential token storage, and stored impersonated-token handling for later GCS enforcement.

- [x] New feature (`feat:`)

Implements the STS v1 form token-exchange contract needed by the Google Java auth-library downscoping flow. Verified with STS REST tests, CAB parser tests, token-store tests, disablement coverage, and compatibility-tests/sdk-test-java StsTokenExchangeTest against a running emulator.

- [x] `./mvnw test` passes locally
- [x] New or updated integration test added
- [x] Commit messages follow Conventional Commits

Enforces Floci downscoped-token CAB rules across GCS object, upload, XML, compose, copy, rewrite, resumable, and batch paths while preserving existing bypass behavior for missing, static, and stored impersonated credentials.

- [x] New feature (`feat:`)

Implements the intentionally limited GCS Credential Access Boundary subset produced by the Google Java downscoped credentials flow. Verified with GcsAuthorizationTest, GcsScopedTokenRestIntegrationTest, existing GCS service coverage, and compatibility-tests/sdk-test-java GcsDownscopedTokenTest against a running emulator.

- [x] `./mvnw test` passes locally
- [x] New or updated integration test added
- [x] Commit messages follow Conventional Commits