auth: AsyncAuthorizedSession.request leaks response across retry attempts

从 packages/google-auth/google/auth/aio/transport/sessions.py 中的 AsyncAuthorizedSession.request 开始，然后将其重试循环与第 501-518 行的清理模式进行比较。为可重试的 503 后跟 200 添加单元测试覆盖，验证在继续重试之前已等待初始响应的 close()。

In google.auth.aio.transport.sessions.AsyncAuthorizedSession.request (packages/google-auth/google/auth/aio/transport/sessions.py:339-347), the retry loop reassigns response = await with_timeout(...) across retry attempts without closing the previous response.

If the response payload hasn't reached EOF before the next retry fires (e.g., with chunked or streaming responses), aiohttp keeps the socket checked out in connector._acquired. The transport protocol's internal EOF callback holds a bound reference to ClientResponse._response_eof, which prevents Python's garbage collector from cleaning up the orphaned response while the connection is waiting for data. Under concurrency, multiple requests retrying against a degraded endpoint can quickly burn through the connector pool (limit=100) and block other outgoing requests across the session.

Proposed Fix

Close any previous response before kicking off the next retry attempt, matching the pattern already used in sessions.py:L501-L518:

response = None
async for _ in retries:
    if response is not None and hasattr(response, "close"):
        try:
            res = response.close()
            if inspect.isawaitable(res):
                await res
        except Exception:
            pass

    response = await with_timeout(
        self._auth_request(
            url, method, data, request_headers, actual_timeout, **kwargs
        )
    )

    if response.status_code not in transport.DEFAULT_RETRYABLE_STATUS_CODES:
        break

Unit tests should check that when a retryable status code (like a 503) is followed by a 200, close() is awaited on the initial response before the retry runs.