fix: add env var to allow disabling directpath bound token (googleapis#4189)

Author: rockspore

google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java

@@ -368,10 +368,12 @@ public GapicSpannerRpc(final SpannerOptions options) {
       boolean isEnableDirectAccess = options.isEnableDirectAccess();
       if (isEnableDirectAccess) {
         defaultChannelProviderBuilder.setAttemptDirectPath(true);
-        // This will let the credentials try to fetch a hard-bound access token if the runtime
-        // environment supports it.
-        defaultChannelProviderBuilder.setAllowHardBoundTokenTypes(
-            Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+        if (isEnableDirectPathBoundToken()) {
+          // This will let the credentials try to fetch a hard-bound access token if the runtime
+          // environment supports it.
+          defaultChannelProviderBuilder.setAllowHardBoundTokenTypes(
+              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+        }
         defaultChannelProviderBuilder.setAttemptDirectPathXds();
       }
 
@@ -687,6 +689,10 @@ public static boolean isEnableDirectPathXdsEnv() {
     return Boolean.parseBoolean(System.getenv("GOOGLE_SPANNER_ENABLE_DIRECT_ACCESS"));
   }
 
+  public static boolean isEnableDirectPathBoundToken() {
+    return !Boolean.parseBoolean(System.getenv("GOOGLE_SPANNER_DISABLE_DIRECT_ACCESS_BOUND_TOKEN"));
+  }
+
   private static final RetrySettings ADMIN_REQUESTS_LIMIT_EXCEEDED_RETRY_SETTINGS =
       RetrySettings.newBuilder()
           .setInitialRetryDelayDuration(Duration.ofSeconds(5L))