Determine this is the right repository

• I determined this is the correct repository in which to report this feature request.

Summary of the feature request

_CLOUD_RESOURCE_MANAGER in google/auth/external_account.py is hardcoded to cloudresourcemanager.googleapis.com. It should respect the configured universe_domain, just like _DEFAULT_TOKEN_URL already does.

Desired code experience

# file: google/auth/external_account.py

# Before — hardcoded to googleapis.com:
_CLOUD_RESOURCE_MANAGER = "https://cloudresourcemanager.googleapis.com/v1/projects/"

# After — universe-domain-aware:
_CLOUD_RESOURCE_MANAGER = "https://cloudresourcemanager.{universe_domain}/v1/projects/"

Credentials constructed with a non-default universe_domain (e.g. sovereign clouds) should automatically use https://cloudresourcemanager.<universe_domain>/v1/projects/ when calling get_project_id().

Expected results

creds = ExternalAccountCredentials(..., universe_domain="example.com")
get_project_id() hits https://cloudresourcemanager.example.com/v1/projects/ instead of cloudresourcemanager.googleapis.com

API client name and version

google-auth (latest)

Use case

Users targeting universe domains other than googleapis.com (e.g. private or sovereign Google Cloud environments) need all endpoint URLs, including the Cloud Resource Manager URL used for project ID resolution, to honor the configured universe domain. The existing _DEFAULT_TOKEN_URL already follows this pattern.

Additional context

The fix mirrors the pattern introduced in 33e8af3 for _DEFAULT_TOKEN_URL. A {universe_domain} placeholder is substituted at credential construction time into self._cloud_resource_manager_url.