[Feature Request] Support configuring universe_domain in repository-gcs for Google Cloud trusted cloud environments

Is your feature request related to a problem? Please describe

The repository-gcs plugin has no way to configure a Google Cloud universe domain other than the default googleapis.com. This makes the plugin unusable against Google Cloud trusted cloud offerings that run in a separate universe domain (for example S3NS in France, whose API endpoints are *.s3nsapis.fr instead of *.googleapis.com).

Today, the function GoogleCloudStorageService#createStorageOptions builds StorageOptions without ever calling .setUniverseDomain(...), so there is no setting a user can pass to work around this.

Describe the solution you'd like

Add a new client-level setting, for example gcs.client.<prefix>.universe_domain, following the same pattern as the existing gcs.client.<prefix>.endpoint setting, and pass its value to StorageOptions.Builder#setUniverseDomain(...) in createStorageOptions() when present. When the setting is absent, keep the current default behavior (googleapis.com), so this is fully backward compatible.

Related component

Plugins

Describe alternatives you've considered

Set the environement variable GOOGLE_CLOUD_UNIVERSE_DOMAIN=s3nsapis.fr into Kubernetes pod env, but the SDK for authentication or storage seems not take it and still fails.

Additional context

Confirmed reproducible with a Workload Identity Federation external_account credential scoped to a non-default universe domain, used against a Google Cloud sovereign cloud instance.

Using a Kubernetes Service Account binded to a GCP Service Account with workload impersonation role. We confirmed that the pod get access to the service account and can generate access token (with metadata endpoint).