feat(auth): add CertRotationInterceptor and MTLSRefreshingChannel for gRPC mTLS

[agrawalradhika-cell]

Part 1 of 2 splitting #18019.

This PR adds the standalone google.auth.transport.mtls_interceptor module (CertRotationInterceptor and MTLSRefreshingChannel) and its unit tests (tests/transport/test_mtls_interceptor.py) to support automatic gRPC mTLS certificate rotation upon UNAUTHENTICATED errors when client certificates rotate.

See go/grpc-cert-rotation-in-pythonsdk-for-x509 for details.

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - b/497848161
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Pre-review checklist

• Split from Part 1 of 2 splitting feat: [grpc] Add retry logic when certificate mismatch for existing credentials & Agent Identity workloads  #18019.
• Self-reviewed the full diff line by line (go/author-standard).
• Tested manually / end-to-end against a real environment.
  • Test script and output:
• Added or updated unit tests covering happy paths and error cases.
• Checked shared code paths for regressions and backwards compatibility.
  • Adjacent features verified: This change doesn't impact any files, this is just a helper
• Checked parity across sibling flows (credential types)
• Out of scope flows and tracking bugs - grpc async

[gemini-code-assist]

Code Review

This pull request introduces an mTLS interceptor and channel wrapper (mtls_interceptor.py) along with comprehensive unit tests to handle automatic certificate rotation and retry logic for gRPC client calls. The review feedback suggests several improvements, including removing defensive getattr checks for guaranteed attributes, logging swallowed exceptions in callback execution blocks to aid in debugging, and implementing missing standard grpc.Call methods in _DeadlineExceededError to prevent potential AttributeError crashes in downstream code.