[CTM-534] check for requester pays

[calypsomatic]

Jira ticket: https://broadworkbench.atlassian.net/browse/CTM-534

Addresses

TDR was using the x-user-project header as the billing project on any signed URL request, regardless of whether the snapshot had requireUserProject=true. Since Terra clients always send this header, all TDR-hosted data (HCA, LungMAP, etc.) was being charged to users — not just AnVIL requester-pays snapshots. This pr gates userProject usage in getUrlSigningOptions and signGoogleUrl on cachedSnapshot.requireUserProject, so TDR only bills the caller when the snapshot explicitly requires it.

Summary of changes

DrsService.java

• getUrlSigningOptions: only uses caller's userProject as billing project when cachedSnapshot.requireUserProject is true
• signGoogleUrl self-hosted branch: same gate — only routes through SAM with userProject when requireUserProject is true

DrsServiceTest.java

• testSignGcpUrl: added snapshot.requireUserProject(true) for the parameterized cases where a billing project is provided — those cases now explicitly test the RP scenario
• testSignGcpUrlWithTokenVariations: added snapshot.requireUserProject(true) to correctly represent a self-hosted AnVIL snapshot
• New test getAccessUrlIgnoresUserProjectForNonRequesterPaysSnapshot: verifies the regression — non-RP snapshot with userProject provided succeeds but doesn't call SAM with the caller's project

Testing Strategy

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
80.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud