gcp_auth(
*,
service_account_json: SandboxProxySecret,
scopes: Sequence[str] | None = Build a sandbox proxy rule that injects GCP OAuth bearer auth.
The sandbox proxy keeps the service account JSON outside the sandbox and
injects OAuth bearer tokens for built-in Google API host matching.
service_account_json must be supplied as a workspace_secret or
opaque value; plaintext service account JSON is intentionally not
supported.