fix: Set the universe domain when using an impersonation chain. (#2547)

This change ensures that the universe domain configuration is correctly passed when setting up an impersonation chain for credentials.

It also introduces internal test infrastructure to mock `impersonate.CredentialsTokenSource` and adds a unit test `TestCredentialsOpt` to verify this behavior.