auth: ADC() and ServiceAccount() fail to mint tokens with "context canceled" #1909

Describe the Bug:

Credentials from auth.ADC() and auth.ServiceAccount() can't mint a token when ADC resolves to gcloud user credentials (authorized_user) or an impersonated service account. Credential() succeeds, then every Apply fails with context canceled.

lazyTokenSource builds the context it passes to init with context.WithTimeout and cancels it with defer cancel() as soon as init returns (providers.go#L255-L256). The golang.org/x/oauth2 token source keeps that context and sends every token request on it (tokenRefresher.ctx), so the context is already canceled when the first request goes out.

Service-account key files and the GCE metadata server aren't affected, because neither sends its token request on that context. So a deployment on Google Cloud works, and local development after gcloud auth application-default login doesn't.

Steps to Reproduce:

1. gcloud auth application-default login
2. Run the snippet below

cred, err := auth.ADC().Credential(context.Background())
if err != nil {
	log.Fatal(err) // not reached
}
h := http.Header{}
if err := cred.Apply(h); err != nil {
	log.Fatal(err)
}

Expected Behavior:
Apply sets Authorization: Bearer ….

Observed Behavior:
Every Apply fails:

auth: mint oauth2 token: Post "https://oauth2.googleapis.com/token": context canceled

Environment Details:

• ADK Library Version: main (900e2fa), and every release since v2.1.0
• OS: Linux
• Go Version: 1.26.6

Model Information: N/A

Regression: No. lazyTokenSource has done this since the auth package was added in #1143.

Additional Context:
initTimeout (30s) still has to stop a hung credential lookup, so the context needs a limit while init runs and none after it returns. A deadline can't be removed once set, so I'm replacing it with a timer that's stopped when init returns. PR: #1904.

How often has this issue occurred?: Always