Function configure_gcs_workload_identity 

pub fn configure_gcs_workload_identity<I, K, V>(
    builder: GoogleCloudStorageBuilder,
    options: I,
    credentials: GcpCredentialProvider,
) -> GoogleCloudStorageBuilder
where
    I: IntoIterator<Item = (K, V)>,
    K: AsRef<str>,
    V: Into<String>,

Apply GCS options while keeping credential material owned by the injected workload-identity provider.

Options are applied in iterator order, matching object_store::parse_url_opts. Credential keys are deliberately omitted so ambient static credentials cannot override an explicitly selected external-account source.