fix(auth): address concurrency crashes, state desync, and test coverage in async mTLS sessions V2

[andyrzhao]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)
  Fixes Add cert rotation handling for aiohttp (Async HTTP) #18227

---

Overview

This PR resolves concurrency crashes, state desynchronization, and authentication recovery regressions in AsyncAuthorizedSession during asynchronous mTLS initialization and certificate rotation.
It builds upon and resolves open gaps identified in #18224 and #18334:

1. Task Shielding & In-Flight Concurrency:
   • In request(), shielded self._mtls_init_task with asyncio.shield so that external caller cancellation does not cancel background session setup. Propagates asyncio.CancelledError cleanly without leaving the session in a corrupt state.
   • In configure_mtls_channel(), awaits any active, in-flight _mtls_init_task before creating a new one, eliminating race conditions that could clobber self._auth_request.
2. Idempotency & Reconfiguration Controls:
   • Correctly handles transitions from a custom client_cert_callback back to default ADC (client_cert_callback=None).
   • Added a force: bool = False parameter to configure_mtls_channel() to allow explicit reconfiguration when dynamic callback providers rotate credentials without changing the callback reference.
3. Lock Contention Deduplication on Failure:
   • In _recover_auth_state(), self._mtls_check_counter is now incremented unconditionally at the end of the check block. If parameter checks fail (e.g. ClientCertError or MutualTLSChannelError), subsequent concurrent tasks waiting on the lock properly detect that the check has already run and bypass redundant validation spikes.
4. Accurate 401 Credential Recovery Semantics:
   • Fixed NotImplementedError handling so that non-mTLS requests with unrefreshable credentials return 401 immediately rather than triggering a futile retry.
   • Separated exceptions.InvalidOperation handling so that static credentials (e.g., CBA / static tokens) that cannot be refreshed will still retry if certificate rotation successfully reconfigured the mTLS channel (channel_reconfigured is True).
5. Clean Session Teardown:
   • In close(), safely drains and closes _old_auth_requests and the active _auth_request in finally blocks, and cancels any pending initialization tasks without swallowing caller exceptions.
6. Default Fingerprint Symmetry:
   • In mtls.check_parameters_for_unauthorized_response(), correctly defaults cached_fingerprint = current_fingerprint when cached_cert is None, ensuring equality checks skip redundant reconfigurations when appropriate.

---

[gemini-code-assist]

Code Review

This pull request enhances the asynchronous mTLS channel configuration and 401 retry/rotation handling in google-auth. Key changes include adding a force parameter to configure_mtls_channel, shielding the initialization task, improving credential refresh logic during reconfiguration, and adding comprehensive unit tests. The review feedback highlights a potential AttributeError when checking cancellation on a None task, suggests cancelling the previous initialization task during reconfiguration to avoid blocking, and recommends mocking time.monotonic locally rather than globally to comply with the repository's style guide.