The GitSCMExtension decorates the GitClient first and then it set the credentials if a credentials ID is provided https://github.com/jenkinsci/git-plugin/blob/git-5.2.2/src/main/java/hudson/plugins/git/GitSCM.java#L929. This behavior was changed a long long time ago though I am not convinced it was intentional https://github.com/jenkinsci/git-plugin/commit/5bbee1ffbfbfe16441b5b5ac09bb2b32fa6fae63.

Maybe the GitClient should be initialized first (credentials included) and GitSCMExtension at the end.

Noticed this particular behavior when working on a bug fix for Bitbucket Branch Source that implements an interesting extension to pass the credentials ID: https://github.com/jenkinsci/bitbucket-branch-source-plugin/blob/888.v8e6d479a_1730/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/GitClientAuthenticatorExtension.java.