chore: add inline comment explaining Domain-Wide Delegation check in jwt.Credentials

Author: nbayati

packages/google-auth/google/auth/jwt.py

@@ -589,6 +589,9 @@ def _build_regional_access_boundary_lookup_url(self, request=None):
 
         Returns None if the subject is populated.
         """
+        # In jwt.Credentials, subject defaults to client_email (which is the issuer).
+        # We must check self._subject != self._issuer to correctly determine if
+        # Domain-Wide Delegation is active.
         if self._subject and self._subject != self._issuer:
             # RAB does not apply to Workspace User Accounts via Domain-wide Delegation.
             return None