fix(transport): propagate mTLS adapter to auth session and fix connection leaks

[nbayati]

This PR is fixing two issues found in the auth library:

1. Adapter Connection Leaks
   Whenever the configure_mtls_channel() method was called, the code would create a new mTLS HTTPAdapter and mount it to "https://". However, it never closed the old adapter it was replacing. Because of how the underlying requests and urllib3 libraries work, the old adapter's connection pool was left open, creating dangling sockets and eventually causing file descriptor exhaustion.
   The Fix: I updated the method to retrieve the existing "https://" adapter (via self.get_adapter()) before replacing it. If an old adapter is found, we now explicitly call old_adapter.close() to shut down its connection pool and cleanly release the sockets back to the OS.

2. Missing Auth Request Session Update (Issue google-auth: mTLS token refresh blindspot due to unconfigured internal helper transport #17680)
   The AuthorizedSession class maintains an internal session called _auth_request_session. This hidden session is specifically responsible for doing background work, like fetching new OAuth tokens or signing IAM requests. When mTLS was enabled, the new secure adapter was only applied to the main user-facing session, completely missing this internal session. As a result, critical token refreshes were bypassing mTLS and failing when they hit strict Certificate-Based Access (CBA) endpoints.
   The Fix: I added logic to check if self._auth_request_session exists during the mTLS configuration. If it does, we now apply the exact same cleanup (closing its old adapter) and then explicitly mount the new mTLS adapter to it. This guarantees that all background token refreshes are routed securely over the mTLS channel.

Also added a documentation warning to clarify that dynamically reconfiguring the channel mutates the underlying session and is not natively thread-safe.

[gemini-code-assist]

Code Review

This pull request updates the configure_mtls_channel method in requests.py to properly close old adapters when mounting a new mTLS adapter, and extends this configuration to _auth_request_session if it exists. It also adds comprehensive unit tests and a thread-safety warning in the docstring. The review feedback correctly points out a potential AttributeError when configure_mtls_channel is called on a base Session instance where _auth_request_session is not defined, and provides an actionable code suggestion to safely access the attribute using getattr.