Give iamSigner pointer receivers so the email cache works

[omlahore]

iamSigner.Email is written to discover the service account once and cache it:

func (s iamSigner) Email(ctx context.Context) (string, error) {
	if s.serviceAcct != "" {
		return s.serviceAcct, nil
	}

	s.mutex.Lock()
	defer s.mutex.Unlock()
	result, err := s.callMetadataService(ctx)
	...
	s.serviceAcct = result
	return result, nil
}

The receiver is a value, so s.serviceAcct = result writes to a copy that is discarded when the method returns. The guard at the top therefore never sees a cached value, and every call re-queries the GCE metadata server over HTTP. Sign calls Email, so that is an extra round trip per custom token minted through the IAM path.

Two things say caching is the intent rather than the value receiver being deliberate: the early-return check exists at all, and mutex is held as a *sync.Mutex so that copies of the struct still share one lock. Guarding a write that cannot persist is only explicable as an oversight.

staticcheck reports it as SA4005, "ineffective assignment to field iamSigner.serviceAcct".

The change moves all four iamSigner methods to pointer receivers together, so the method set stays consistent. newIAMSigner already returns *iamSigner, newCryptoSigner passes that straight through, and auth_test.go:129 asserts client.signer.(*iamSigner), so nothing stores a bare iamSigner value and the cryptoSigner interface is still satisfied.

Verified: go build ./... passes, go test ./auth/... green, gofmt -l clean, SA4005 gone under GOOS=linux and GOOS=darwin.

Separately, and not included here since it is a different concern: auth/user_mgt.go:1463-1464 and auth/project_config_mgt.go:29 spell the struct tag option omitEmpty, which encoding/json does not recognise (it only accepts omitempty). Both structs are decode-only today so nothing misbehaves at runtime, but the tags do not do what they read as. Say the word and it goes in a separate PR.

[gemini-code-assist]

Code Review

This pull request updates the receiver type of iamSigner methods in auth/token_generator.go from value to pointer receivers. The review feedback highlights that this change introduces a data race and a concurrency bug in the Email method due to unprotected concurrent access to s.serviceAcct, and suggests acquiring the lock at the beginning of the method to ensure thread safety and prevent redundant metadata service calls.