[Anshu6250]

Summary

Implements client-side Certificate-Based Access (mTLS) support in the Google Cloud BigQuery ODBC Driver following Google API design standard AIP-4114.

This is Part 1 of the mTLS support series. It introduces the foundational mTLS configuration structures, in-memory PEM parser, SecureConnect / Endpoint Verification (cert_provider_command) process spawner, AIP-4114 configuration resolver, composite gRPC channel credentials builder, and unit test suite in bq_client_interface.

---

Key Changes

1. Client Interface & Core Engine

• google/cloud/odbc/bq_client_interface/odbc_authentication.h:
  • Added struct MtlsOptions (use_client_certificate, use_mtls_endpoint, client_certificate_path, client_private_key_path) and MtlsOptions mtls; to struct ConnProps.
• google/cloud/odbc/bq_client_interface/mtls.h/.cc:
  • AIP-4114 Resolver (ResolveMtlsConfig):
    • Prioritizes DSN properties > Environment variables (GOOGLE_API_USE_CLIENT_CERTIFICATE, GOOGLE_API_USE_MTLS_ENDPOINT) > Default device certificate.
    • Guards against non-default universes (rejects mTLS outside googleapis.com per AIP-4114).
  • In-Memory PEM Parser (SplitPemBundle & LoadClientCertificateFromFiles):
    • Parses certificate chains and unencrypted private keys (PKCS#8, legacy PKCS#1 RSA, SEC1 EC).
    • Eagerly detects and rejects encrypted private keys with descriptive errors.
  • Secure Process Spawner (ParseCertProviderCommand & RunCommandCaptureStdout):
    • Executes cert provider commands without invoking a shell to prevent command injection.
    • Windows: Uses Win32 CreateProcessA with CREATE_NO_WINDOW and MS CRT argument quoting.
    • Linux/macOS: Uses posix_spawnp (thread-safe for ODBC driver hosting applications).
    • Safely drains pipes in a loop to eliminate deadlocks on large stdout streams.
  • gRPC Channel Credentials (MakeMtlsGrpcChannelCredentials):
    • Builds composite credentials combining client TLS certificates with OAuth2 Bearer access tokens.
• google/cloud/odbc/bq_client_interface/CMakeLists.txt & odbc_bq_client_interface.bzl:
  • Registered mtls.h and mtls.cc in the odbc_bq_client_interface library target.

2. Tests

• google/cloud/odbc/bq_client_interface/mtls_test.cc:
  • 35 unit test cases covering PEM parsing, metadata parsing, process execution, pipe draining, resolution precedence, and credential assembly.

---

PR Series

1. Part 1 (This PR - feat(bq_client_interface): add core mTLS primitives, AIP-4114 config resolver, and unit tests #1689): Core mTLS primitives, AIP-4114 config resolver, and unit tests in bq_client_interface.
2. Part 2 (feat(bq_driver): add mTLS DSN configuration parsing and connection handle setup #1702): Driver DSN configuration parsing, ConnectionHandle setup, and unit tests in bq_driver.
3. Part 3 (feat(bq_client_interface): wire mTLS into BigQuery REST/gRPC clients and add integration tests #1703): BigQuery REST/gRPC client mTLS endpoint/credential wiring and end-to-end ODBC integration tests.

[shivamd-gpartner]

@Anshu6250 please split this PR

[sachinpro]

If this is used only for integration tests, lets remove this since we are setting it through integration tests.