Use One Proxy Transport for Firebase Admin Java and Token Refresh

Configure both transport inputs when Firebase HTTP calls and credential refresh must use the same proxy. A public HTTP endpoint chosen from the HTTP proxy list needs this same pair of handoffs:

var proxy = new java.net.Proxy(
    java.net.Proxy.Type.HTTP,
    new java.net.InetSocketAddress("proxy.example.net", 8080));

var transport =
    new com.google.api.client.http.javanet.NetHttpTransport.Builder()
        .setProxy(proxy)
        .build();

var credentials = com.google.auth.oauth2.GoogleCredentials.fromStream(
    serviceAccountStream, () -> transport);

var options = com.google.firebase.FirebaseOptions.builder()
    .setCredentials(credentials)
    .setHttpTransport(transport)
    .build();

var app = com.google.firebase.FirebaseApp.initializeApp(options);

The two important handoffs are fromStream(serviceAccountStream, () -> transport) and setHttpTransport(transport). The first supplies the HTTP transport for obtaining access tokens; the second supplies the Firebase app's HTTP transport. Setting just one can leave the other on its default route.

serviceAccountStream is the application's trusted service-account credential stream. Keep the app for its workload and release it through the normal Firebase lifecycle. The proxy setting leaves the destination hostname intact for TLS verification; it requires neither SDK class replacement nor a trust-all SSL factory.

The scope here is the shown HTTP interfaces. A workload using Realtime Database WebSocket or another service transport needs that transport's routing support checked separately.