fix(auth): allow mTLS retry when credentials raise NotImplementedError on refresh

[mmckenzie-confl]

Summary

• In AsyncAuthorizedSession.request()'s inner _recover_auth_state() function
  (google/auth/aio/transport/sessions.py), the except NotImplementedError branch
  incorrectly did return response, returning the original 401 to the caller instead of
  falling through to return None to trigger a retry.
• This caused the first request after a client certificate rotation to fail with a 401 for
  credential types that do not implement refresh() (e.g., Agent Identity workloads), even
  though the mTLS channel was successfully reconfigured.
• The RefreshError branch correctly returns the 401 (a real refresh failure means
  recovery failed), but NotImplementedError is not an error — it means the credential
  simply doesn't support refresh. The mTLS reconfiguration was still successful, and the
  retry should proceed.

This recovery path was introduced in #18224.

Extension of the fix for #18227

Test plan

• Added regression test test_cert_rotation_credential_refresh_not_implemented_retries that verifies credentials raising NotImplementedError on refresh still get a retry after mTLS reconfiguration
• All 28 mTLS session tests pass
• All 29 general session tests pass

[gemini-code-assist]

Code Review

This pull request removes an early return statement in sessions.py when credentials do not implement refresh(), allowing the handler to fall through and trigger a retry after mTLS reconfiguration. A corresponding unit test was added to verify this behavior. The review feedback points out a violation of the Repository Style Guide (Rule 20: Fallback Verification) regarding the use of generic assert_called_once assertions instead of explicit argument verification with assert_called_once_with in the new test case.

[andyrzhao]

Hi mmckenzie-confl, thank you so much for putting up this PR. Unfortunately, the previous reviewer is OOO, and after reviewing and discussing this issue with other maintainers, we feel like we need to revisit #18224 which introduced some separate concurrency issues that needs to be patched - this is outside the scope of your current PR. As such, in the short term, we are going to recommend that for all Agent Identity 401 issues related async aiohttp, that the user opts out of "mTLS enforcement" by setting the flag documented here to false: https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/agent-identity#opt-out-caa I will keep you posted on the outcome of the internal PR reviews over the next several days. Thanks for your patience!

Update: Sent out #18355 for maintainer review. Thanks!