Malformed identity JWT encoding raises instead of expiring the cached token

从 ComputeMetadata#determine_identity_lifetime 开始，重现 issue 中描述的无效 URL-safe Base64 情况。检查现有的 malformed JSON 处理，并验证 malformed JWT payload 会产生零 lifetime，同时不改变 valid-token lifetime 路径。确认相关测试套件仍然通过。

Summary

ComputeMetadata#determine_identity_lifetime rescues malformed JSON, but not malformed URL-safe Base64 in the JWT payload. A metadata response containing an invalid encoded payload therefore raises ArgumentError while deciding its cache lifetime instead of treating the token as immediately expired.

Reproduction

On current main (7936c72eb2c809214858f47473aafb04c6bbf469), calling the private lifetime calculation with an identity path and a token whose middle segment is invalid URL-safe Base64 raises ArgumentError from Base64.urlsafe_decode64.

Proposed correction

Handle ArgumentError alongside the existing malformed-JSON behavior and return a zero lifetime. I verified the two-line rescue against malformed padding/characters, the full current suite (91 runs / 419 assertions / 0 failures / 0 errors / 2 skips), and the normal valid-token lifetime path.

I used an AI coding assistant during investigation and verification. I am opening this issue first because this repository requires tests and a Google CLA for pull requests; I have not modified repository tests or signed a CLA as part of this audit.