Update gaxios to 7.2.0 in gcp-metadata

[wellu-h]

gcp-metadata is pinning gaxios@7.1.3, which pulls in rimraf. That version of rimraf has a downstream dependency to brace-expansion@2.1.x with this flagged security vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-13149

Dependency tree:

│   └─┬ gcp-metadata@8.1.3
│     └─┬ gaxios@7.1.3
│       └─┬ rimraf@5.0.10

[trentm]

Seconded. I'm happy to create a PR for this.
I'm a maintainer of OpenTelemetry JS, and the @opentelemetry/resource-detector-gcp is using gcp-metadata.

(The rimraf dep was moved to a devDep of gaxios back in Nov 2025, but there hasn't be bump here.)