Fix Google Discovery invocation credentials

[lildesert]

Summary

Fixes Google Discovery tool invocation so source-level credentials are applied to real API calls, and fixes reserved path parameter expansion for templates such as {+customerId}.

Root Cause

Google Discovery source credentials were resolved when probing/fetching discovery documents, but invocation did not resolve or merge source.credentials.headers / source.credentials.queryParams into the outbound request. APIs such as Google Ads require source-level headers like developer-token, so generated tools failed with upstream errors such as DEVELOPER_TOKEN_PARAMETER_MISSING even though the source had a configured credential.

The path-template resolver also treated {+customerId} as a literal parameter named +customerId, while the discovery parameter is named customerId. That caused requests like Google Ads campaign search to expand the customer id as empty.

Changes

• Resolve secret-backed Google Discovery source credentials during invocation.
• Apply resolved source credential headers and query params to outbound requests.
• Support reserved path templates by stripping the leading + for parameter lookup and preserving reserved characters when encoding.
• Extend the Google Discovery plugin test to cover source headers, source query params, and {+fileId} path expansion.

Validation

bun run --cwd packages/plugins/google-discovery test src/sdk/plugin.test.ts
bun run --cwd packages/plugins/google-discovery typecheck

Typecheck passes with existing unrelated warnings/suggestions.