feat(gcs): support explicit access token via GOBUILDCACHE_GCS_ACCESS_TOKEN

[odsod]

Summary

When GOBUILDCACHE_GCS_ACCESS_TOKEN is set, the GCS backend uses the provided OAuth2 access token directly via option.WithTokenSource instead of relying on Application Default Credentials (ADC).

Motivation

In Google Cloud Build, docker run containers on the cloudbuild bridge network cannot reach the GCE metadata server at 169.254.169.254 (link-local addresses are not routable from Docker bridge networks). This causes storage.NewClient(ctx) to hang indefinitely waiting for ADC via metadata, which in turn causes Go's GOCACHEPROG to print "still waiting for GOCACHEPROG gobuildcache" until the build times out.

The fix allows the Cloud Build step script (which CAN reach metadata) to fetch a token and pass it explicitly:

TOKEN=$(curl -sf "http://metadata.google.internal/.../token" -H "Metadata-Flavor: Google" | jq -r '.access_token')

docker run --rm \
  -e GOCACHEPROG=gobuildcache \
  -e GOBUILDCACHE_GCS_ACCESS_TOKEN=${TOKEN} \
  -e GOBUILDCACHE_BACKEND_TYPE=gcs \
  -e GOBUILDCACHE_GCS_BUCKET=my-bucket \
  ...

Changes

• pkg/backends/gcs.go: Check GOBUILDCACHE_GCS_ACCESS_TOKEN env var; if set, pass option.WithTokenSource(oauth2.StaticTokenSource(...)) to storage.NewClient
• main.go: Document the new env var in help text