fix(auth/credentials): error on bad file name if explicitly set (#10018)

Only want our fall-through logic to work for ADC specified behaviour, not explicit credential options.

Fixes: #9809

auth/credentials/detect.go

diff --git a/auth/credentials/detect.go b/auth/credentials/detect.go
index 5723ae9..cb3f44f 100644
--- a/auth/credentials/detect.go
+++ b/auth/credentials/detect.go
@@ -76,7 +76,10 @@
 	if opts.CredentialsJSON != nil {
 		return readCredentialsFileJSON(opts.CredentialsJSON, opts)
 	}
-	if filename := credsfile.GetFileNameFromEnv(opts.CredentialsFile); filename != "" {
+	if opts.CredentialsFile != "" {
+		return readCredentialsFile(opts.CredentialsFile, opts)
+	}
+	if filename := os.Getenv(credsfile.GoogleAppCredsEnvVar); filename != "" {
 		if creds, err := readCredentialsFile(filename, opts); err == nil {
 			return creds, err
 		}

auth/credentials/detect_test.go

diff --git a/auth/credentials/detect_test.go b/auth/credentials/detect_test.go
index 8219a9b..9566137 100644
--- a/auth/credentials/detect_test.go
+++ b/auth/credentials/detect_test.go
@@ -688,6 +688,15 @@
 	}
 }
 
+func TestDefaultCredentials_BadFileName(t *testing.T) {
+	if _, err := DetectDefault(&DetectOptions{
+		CredentialsFile: "a/bad/filepath",
+		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
+	}); err == nil {
+		t.Fatal("got nil, want non-nil err")
+	}
+}
+
 func TestDefaultCredentials_Validate(t *testing.T) {
 	tests := []struct {
 		name string