Fix GCS downscoped credential prefix boundary for locations without trailing slash

[vigneshio]

Summary

Tightens the CEL expressions used for GCS credential downscoping in GcpCredentialsStorageIntegration.

When a table or namespace location does not end with / (e.g. gs://bucket/db/table), the previous startsWith rules could match sibling prefixes such as db/table2 or db/table-secret/....

The fix updates both the resource name condition and the list prefix condition:

• Paths that end with / or are empty keep the existing startsWith behaviour.
• Bare paths now use startsWith('<path>/') || resource.name == '<path>' (and the symmetric form for the objectListPrefix attribute).

Changes

• Updated resourceNameStartsWithExpression(...) and objectListPrefixStartsWithExpression(...)
• Added explicit regression test testGenerateAccessBoundaryPreventsSiblingPrefixBypass
• Updated affected test golden files and string assertions
• Added entry to CHANGELOG.md

This is a security hardening change for subscoped storage credentials.

Checklist

• Don't disclose security issues! (contact security@apache.org)
• Clearly explained why the changes are needed
• Added/updated tests with good coverage
• Updated CHANGELOG.md
• Updated documentation in site/content/in-dev/unreleased (not needed for this internal fix)

[dimas-b]

Thanks, @vigneshio !