ret := &xdsAddr{host: u.Host}
	if !strings.HasSuffix(ret.host, ":443") {
		ret.host += ":443"
	}
	const projSeg = "/projects/"
	i := strings.Index(u.Path, projSeg)
	if i == -1 {
		return nil, fmt.Errorf("webhook URL %s doesn't contain the projects segment", u)
	}
	i += len(projSeg)
	j := strings.IndexByte(u.Path[i:], '/')
	if j == -1 {
		return nil, fmt.Errorf("webhook URL %s is malformed", u)
	}

	ret, err := creds.GetRequestMetadata(ctx, uri...)
	if err != nil {
		return err
	}
	for k, v := range ret {
		if !strings.EqualFold(k, "authorization") {
			if _, ok := dst[k]; ok {
				return fmt.Errorf("underlying %s credentials contain a %s header which is already present in the combined credentials", kind, k)
			}

}

func mcpTransport(ctx context.Context, tr http.RoundTripper) (http.RoundTripper, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, fmt.Errorf("finding default GCP credentials: %w", err)
	}
	return &oauth2.Transport{
		Base:   tr,
		Source: creds.TokenSource,
	}, nil