Follows the changes in #1839 (PR that reverts the call to retrieve the default service account when refreshing the access token).
There was a suggestion in b/458269866 to directly call http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email to get the princpcal instead of http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/?recursive=true and parsing for the email.
From testing locally, this looks to work as intended and returns a string value instead of json.