feat(secrets): begin migration to secret manager from keystore

[bcoe]

This work begins migrating secrets for Node.js from keystore to Secret Manager.

After discussing a few possible approaches with @chingor13, @tmatsuo, and @busunkim96, I ultimately landed on the dead simple approach of:

1. using a shared service account that has access to the secrets in question.
2. running a script in the context of the docker container that's running tests (which we can have a new version of secret manager with secrets on).

I think the only impact this has on Trampoline V2, is that we might want to use a service account made specifically for this purpose.

[tmatsuo]

Trampoline V2 will pass down KOKORO_GFILE_DIR and it's content, so as long as your Kokoro job has the configuration for the bucket, it should be fine.

[bcoe]

Here's an example of the approach outlined here in action:

googleapis/nodejs-secret-manager#110

[SurferJeffAtGoogle]

Is the kokoro-trampoline.service-account.json file in place and ready to go?

[tmatsuo]

Suggestion:

Docker runs with uid 0 by default. It will likely create root owned files which might be ok, but who knows.
I'd try detecting uid and gid then pass --user flag.

user_uid="$(id -u)"
user_gid="$(id -g)"
# then pass
--user "${user_uid}:${user_gid}"

WDYT?