fix: Set the universe domain when using an impersonation chain. (#2547)

This change ensures that the universe domain configuration is correctly passed when setting up an impersonation chain for credentials.

It also introduces internal test infrastructure to mock `impersonate.CredentialsTokenSource` and adds a unit test `TestCredentialsOpt` to verify this behavior.

Author: hessjcg

internal/proxy/proxy.go

@@ -342,6 +342,9 @@ func credentialsOpt(c Config, l cloudsql.Logger) (cloudsqlconn.Option, error) {
 	// credentials token source.
 	if c.ImpersonationChain != "" {
 		var iopts []option.ClientOption
+		if c.UniverseDomain != "" {
+			iopts = append(iopts, option.WithUniverseDomain(c.UniverseDomain))
+		}
 		switch {
 		case c.Token != "":
 			l.Infof("Impersonating service account with OAuth2 token")