feat(storage): enable default CRC32C checksum validation for object downloads

[salilg-eng]

Overview

Enables full object checksum validation (CRC32C by default) across GCS JSON read paths, covering all four download methods: downloadAsString, downloadToFile, downloadAsStream, and downloadAsStreamAsync.

It integrates a HashValidatingStream decorator that computes hashes on-the-fly and validates them upon reaching the end of the stream.

Key Features

• CRC32C by Default: Prioritizes lightweight, hardware-accelerated CRC32C validation.
• MD5 Fallback: Automatically falls back to validating MD5 if a CRC32C hash is not available on the GCS object.
• Configurable Options: Supports user overrides through the 'validate' parameter (crc32, md5, or false to disable).
• Subrange Bypass: Bypasses checks automatically on partial range downloads (HTTP 206 Partial Content) where full object validation is incompatible.

Buganizer Tasks Resolved

• Fixes b/514548528 ([PHP] SDK: Full object checksum for all JSON and XML Reads as well)

Testing

• Added new unit tests in HashValidatingStreamTest.php.
• Added sync/async integration test cases inside RestTest.php.

[kalragauri]

IIUC, wrapping the transcoded stream in maybeWrapWithHashValidatingStream here will cause a 100% failure rate for compressed files because GCS serves uncompressed bytes on transcoding, whereas X-Goog-Hash contains the hash of the stored compressed bytes. Can we implement on-the-fly decompression and verification?

cc: @v-pratap what do you recommend?

[salilg-eng]

I have updated the logic to check GCS's X-Goog-Stored-Content-Encoding header. If this header is present (indicating transcoding occurred), the validator now safely and automatically bypasses validation, which aligns with how GCS client libraries in other languages (like Java, Go, and Python) handle transcoding. I also added a dedicated unit test testDownloadObjectWithTranscodedObjectValidationBypassed to verify this behavior.

[kalragauri]

Thanks. I'll let Vaibhav confirm if bypassing this is okay. Let's keep this unresolved for now.