Scope Vertex AI credentials to cloud-platform

[subhashpolisetti]

Problem

In Vertex AI mode, the google-genai starter loads the service-account
credentials from spring.ai.google.genai.credentials-uri and currently
applies them to the client without an OAuth scope. GoogleCredentials.fromStream
returns scopeless credentials, so Vertex AI rejects the access-token
refresh with invalid_scope and no chat request can complete:

GoogleAuthException: Error getting access token for service account:
400 Bad Request POST https://oauth2.googleapis.com/token
{"error":"invalid_scope"}

Only the explicit credentials-uri path is affected; the Application
Default Credentials path is scoped by the underlying SDK. There is no
configuration workaround today: there is no scope property, and the
Client bean is @ConditionalOnMissingBean with no customizer, so the
only escape is replacing the entire bean.

Fix

Scope the credentials loaded from credentials-uri to cloud-platform,
matching the scope the SDK applies to Application Default Credentials.

Testing

Adds GoogleGenAiChatAutoConfigurationTests, which is fully
self-contained (no network, no real key, no environment variables — it
generates a throwaway RSA keypair and a synthetic service-account JSON):

• one test pins the root cause: credentials from
  GoogleCredentials.fromStream carry no scope;
• one test verifies the fix: the loaded credentials are scoped to
  cloud-platform.

I also verified the behavior end to end against a real Google Cloud
service-account key. The unit test can only assert the scope offline,
because invalid_scope is returned by a live token exchange — the exact
call the SDK makes (refreshIfExpired() on the provided credentials):

// unscoped credentials (current behavior)
GoogleCredentials.fromStream(key).refreshIfExpired();
// 400 Bad Request POST https://oauth2.googleapis.com/token
// {"error":"invalid_scope","error_description":"Invalid OAuth scope or ID token audience provided."}

// scoped to cloud-platform (the fix)
GoogleCredentials.fromStream(key)
    .createScoped(List.of("https://www.googleapis.com/auth/cloud-platform"))
    .refreshIfExpired();
// access token obtained

Fixes #6595

[mikecollard]

lgtm