fix(auth): harden X.509 workload identity integration (#3740)

## Summary

- Make X.509 workload identity consistent across synchronous and
asynchronous clients, supported data-residency regions, client copies,
and explicit authentication configuration.
- Preserve caller-owned HTTP clients, request hooks, custom HTTPS
origins and TLS configuration, retry behavior, token refresh, and
request replay compatibility.
- Add focused synchronous, asynchronous, concurrent, legacy-HTTPX, and
workload-identity regression coverage without changing the public API or
custom-code budget policy.

## Validation

- Full repository tests: **9,425 passed, 32 skipped**.
- Focused X.509 and compatibility tests: **340 passed, 2 skipped**.
- Legacy HTTPX compatibility tests: **137 passed**.
- Large-payload compatibility regression passed.
- Ruff, whole-repository pyright, and mypy across 1,576 files passed.
- Wheel and source distributions built successfully; package metadata
and Bedrock packaging validated.
- Existing custom-code budget passed: **6,574 / 10,000**.