Empty credentials path behavior regression and credentials validation can reject valid JSON files

Problem/Motivation

Since #3608330, gacGetFeed() throws a RuntimeException when the credentials JSON path is empty, while 4.0.8 let google/auth fall back to Application Default Credentials (gcloud ADC file, GCP metadata server). With an empty path, we should skip both the exception and putenv(), so the SDK can use ADC again.

Since #3608330, the auth form and hook_requirements() only accept credentials JSON files with "type": "service_account", which rejects authorized_user, external_account and other types that google/auth supports and that worked in 4.0.8. Validation should accept any valid JSON file with a non-empty "type" key.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes