feat: support custom token endpoint from service account credentials

[stackitcarlos]

Description

This PR introduces the ability to override the default token URL by reading a custom token endpoint directly from the Service Account Key credentials.

To implement this cleanly and avoid deeply nested conditional logic during initialization, a new helper function was added. This safely resolves the token URL while guaranteeing the default fallback behavior if the credentials or endpoint are missing.

Note: This PR serves as a preliminary step toward implementing Architecture Decision Record (ADR) 0025.

Key Changes:

• Extended KeyFlowConfig with a GetCredentialsTokenEndpoint helper to safely extract custom token URLs from service account credentials.
• Updated KeyFlow.Init to use the new helper, allowing the flow to fallback to the default tokenAPI gracefully if no custom endpoint is provided.
• Added standard Go doc comments for KeyFlow methods to improve code readability.
• Expanded TestKeyFlowInit to assert the resolved TokenUrl and added a new table-driven test scenario to verify the custom endpoint logic.

Checklist

• Issue was linked above
• No generated code was adjusted manually (check comments in file header)
• Changelogs
  • Changelog in the root directory was adjusted (see here)
  • Changelog(s) of the service(s) were adjusted (see e.g. here)
• VERSION file(s) of the service(s) were adjusted
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Unit tests got implemented or updated
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)