Enhance 'unauthenticated' auth type for GCS storage

[szisiu]

This is related to

• Should be possible to use GCS without authentication #25810 (https://github.com/trinodb/trino/pull/25811/files)
• Explicit auth and emulating Google Cloud Storage as object storage for Iceberg #26854

What your current code does (v477)

In GcsServiceAccountAuth, if neither jsonKey nor jsonKeyFilePath is supplied and ADC cannot be resolved, the catch block returns null, so we simply never call builder.setCredentials(...). That means the Storage client is built with credentials == null. In practice, the google-cloud-storage library will then send requests without an Authorization header.

Potential downsides of just “null”

• Silent failure: If you accidentally run against real GCS (not eg a fake server) and no credentials are available, you won’t see an early, explicit error; you’ll just get 401/403 when making calls.
• Repeated ADC attempts: In some library versions, constructing clients or performing certain operations may retry ADC resolution internally, adding overhead or noisy logs (to be verified in the current version).
• Ambiguity: It’s not obvious to a future reader that “null” was intentionally used to mean “unauthenticated mode.”

Proposal

• Prefer explicit NoCredentials for clarity. The GCS library provides NoCredentials.getInstance(). This documents intent and prevents future code paths from trying to refresh tokens.
• We could add NoCredentials to GcsServiceAccountAuth
• We could add a new GcsNoAuth auth type that is configurable with UNAUTHENTICATED (in GcsFileSystemConfig)

WDYT?

[ebyhr]

cc: @chenjian2664

[szisiu]

Also it is not possible (at least I cannot figure it out) to use GCS without credentials Trino 477 Release notes.

With default config options, ie: gcs.use-access-token set to false and gcs.json-key/gcs.json-key-file-path empty Trino v477 (Iceberg + GCS) fail to start due to config validation check:

The documentation about those changes are also missing (or not updated): https://trino.io/docs/current/object-storage/file-system-gcs.html#authentication