feat: adds service account impersonation to ExternalAccountClient

[bojeil-google]

If the service_account_impersonation_url is provided, an additional step to exchange the external account GCP access token for a service account impersonated token is performed.

This is needed because many Google Cloud services do not yet support external account GCP access tokens.

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (byoid@1174e4a). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff            @@
##             byoid    #1041   +/-   ##
========================================
  Coverage         ?   92.95%           
========================================
  Files            ?       24           
  Lines            ?     4952           
  Branches         ?      572           
========================================
  Hits             ?     4603           
  Misses           ?      349           
  Partials         ?        0           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1174e4a...b0aa591. Read the comment docs.

[google-cla]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[bojeil-google]

Note that the changes in test.externalclient.ts are half of what they actually appear in the GitHub diff. Visual code seems to catch the indentations and not treat them as changes whereas GitHub detects them as new changes.

Previous structure:

describe('getAccessToken()', () => {
  it('test1', () => {
  }),
  it('test2', () => {
  }),
  ...
});

New changes:

describe('getAccessToken()', () => {
  // Same existing tests.
  describe('without service account impersonation', () => {
    it('test1', () => {
    }),
    it('test2', () => {
    }),
    ...
  });
  
  // New tests with sa impersonation.
  describe('with service account impersonation', () => {
    it('test1 with sa impersonation', () => {
    }),
    it('test2 with sa impersonation', () => {
    }),
    ...
  });
});

[bcoe]

☝️ @JustinBeckwith pointed this setting out to me the other day, if you ever bump into a situation where whitespace is making review hard.

[bojeil-google]

☝️ @JustinBeckwith pointed this setting out to me the other day, if you ever bump into a situation where whitespace is making review hard.

👍 Wow, this is super helpful. I didn't know about this. Thanks for sharing. I don't know why this setting isn't on by default.