feat: support universe domain in service account and metadata credentials

[bshaffer]

Requirements

• 1. Authentication libraries must read the universe_domain property from the credentials files (done feat: add support for universe domain (phase 1) #477)
• 2. Authentication libraries must allow the end-user to set the universe_domain in code
• 3. Authentication libraries must use the universe_domain variable/property/method name
• 4. Authentication libraries must not use hardcoded non-constant information in the authentication flows
• 5. Authentication libraries must implement retrieving the universe_domain from the VM Metadata Server
• 6. Authentication libraries must expose the universe_domain in all credentials classes (done in feat: add support for universe domain (phase 1) #477)
• 7. Authentication libraries must add the universe_domain property to the token authentication credentials constructor (if supported) and document the default behavior Not applicable unless we add an Access Token credential type
• 8. Authentication libraries must only attempt self-signed JWT flow for Service Accounts when authenticating outside googleapis.com
• 9. Authentication libraries must throw an Exception if domain-delegation is configured for Service Accounts when authenticating outside googleapis.com
• 10. Authentication libraries must implement IdToken flow for Service Accounts when authenticating outside googleapis.com or throw an exception

Dependencies

• This now relies on feat: respect sub for domain-wide delegation in service account creds #505 for requirement 9, as this previously was not behaving as expected.

[vishwarajanand]

Should we also throw in case there's domain-delegation?
I am not very sure but it appears that we need to throw (near line#146) in case sub as well as universe_domain is set in the key, as per AL9 of the universe domain spec

[bshaffer]

Thank you for catching this, I completely missed it. PHP definitely supports domain-delegation

google-auth-library-php/src/Credentials/ServiceAccountCredentials.php

Lines 114 to 115 in b687d5e

	* @param string $sub an email address account to impersonate, in situations when
	* the service account has been delegated domain wide access.

I'll look more into it

[bshaffer]

Okay, I added the exception and test in 5f8b409, and added a fix for domain-wide delegation that we had missed in #505

[vishwarajanand]

Approved it

[vishwarajanand]

Lgtm, approving since there are no major comments.

Tests:

1. I tested the changes on apis-tpclp.goog universe domain and validated that ServiceAccountCredentials generates a valid access_token while using the provided universe domain value.

2. I was also able to query the compute instances in the project on the URL: https://compute.apis-tpclp.goog/compute/staging_v1/<more params>, which captures the universe domain in the endpoint.

3. When I use the access token generated in step#1, and use the regular compute api:
   https://compute.googleapis.com/compute/staging_v1/<more params> I see an expected failure with error code 401 and status UNAUTHENTICATED:

Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.