fix(auth): keep subject when copying impersonated credentials

[Om-singhaI]

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #18428 🦕

_make_copy in google/auth/impersonated_credentials.py rebuilds the credential through self.__class__(...) and forwards every constructor argument except subject. The domain wide delegation flow landed in 34ee3fe on the old repo, after that helper already existed, and the helper was never updated. The same field in google/oauth2/service_account.py is forwarded by its own _make_copy.

So with_scopes(), with_quota_project() and the deprecated with_trust_boundary() return a credential that has quietly stopped doing domain wide delegation. It refreshes through :generateAccessToken, so the token belongs to the service account rather than the user, and it rebuilds the Regional Access Boundary lookup URL that #17763 skips while a subject is set.

Anyone whose setup works today because the copy drops the subject would see a change, but that means relying on the copy authenticating as the service account.

What changed:

• _make_copy passes subject=self._subject, next to the arguments it already passes.
• Three tests in tests/test_impersonated_credentials.py: the subject survives with_quota_project and the RAB lookup URL stays None, the subject survives with_scopes, and a scoped copy still refreshes through :signJwt.

Testing, from packages/google-auth on macOS 26.6.2 with Python 3.13.15 and pip install -e ".[requests]":

• python -m pytest tests/test_impersonated_credentials.py -q: 62 passed, against 58 on main.
• python -m pytest tests/test_credentials.py -q: 25 passed. python -m pytest tests/test__default.py -q: 96 passed.
• Reverting only google/auth/impersonated_credentials.py to main and keeping the new tests: all four new cases fail, two on assert None == 'user@example.com' and two with a RefreshError because the copy posts to :generateAccessToken.
• ruff check --select I --line-length=88 and ruff format --check --line-length=88 pass on both files, and flake8 google/auth/impersonated_credentials.py tests/test_impersonated_credentials.py is clean. My ruff was 0.15.17, not the pinned 0.14.14.
• The added source line sits inside _make_copy, on the path the new assertions read, so it's covered.

[gemini-code-assist]

Code Review

This pull request updates the _make_copy method in impersonated_credentials.py to preserve the subject attribute when copying credentials. It also adds corresponding unit tests to ensure that with_quota_project and with_scopes correctly preserve the subject and maintain expected behaviors, such as domain-wide delegation. There are no review comments to address.