feat: adds ability to provide redirect uri

[chalmerlowe]

WIP PR for discussion: aiming to provide the ability to include a redirect URI, client ID, and client secrets to facilitate the migration away from "out of band" (OOB) OAuth authentication.

NOTE: the OOB process is sunsetting in January so this update will be important to incorporate prior to then.

@tswast

See also changes in these repos:

• feat: adds ability to provide redirect uri googleapis/python-bigquery-pandas#595
• feat: adds ability to provide redirect uri googleapis/google-auth-library-python-oauthlib#259
• feat: adds ability to provide redirect uri #58

[tswast]

I think this might be slightly easier to follow if we rename "self" to "flow" or something similar. AFAIK, the name "self" is only a convention, and even if we're monkeypatching, I think a different name would be easier to follow.

Also, if we're passing in redirect_uri does this actually need to be a closure function? Could we move this to a private method of the auth module?

[chalmerlowe]

Done.

[tswast]

As far as I can tell, we only use public methods in run_webapp. I wonder if monkeypatching is actually necessary?

Suggested change

	credentials = app_flow.run_webapp(redirect_uri=redirect_uri)
	credentials = run_webapp(app_flow, redirect_uri=redirect_uri)

[chalmerlowe]

Done.

[TiPPeX2]

@chalmerlowe, I got an email stating the deprecation scheduled onset May 1st.
Does this fixes(adding separate client/secret/uri) addition will work?

We are writing to let you know that using the OOB (Out of Band) OAuth authentication workflow with the BigQuery connector library for pandas (pandas-gbq) and auth helper library ([pydata-google-auth] will be disabled on May 1, 2023. At the onset, we’d like to apologize for any impact this issue may have caused on your organization, and will do our best to support you.

According to definition of OOB, it still an OOB activity and users will still need to copy/paste the token.
Am I correct?

What is OOB? OAuth [out-of-band (OOB)](https://developers.google.com/identity/protocols/oauth2/native-app#manual-copypaste), also referred to as the manual copy/paste option, is a legacy flow developed to support native clients which do not have a redirect URI to accept the credentials after a user approves an OAuth consent request. The OOB flow poses a remote phishing risk and clients must migrate to an alternative method to protect against this vulnerability.
From what I saw you already have a fix of supply a default(non localhost) redirect_uri(WEBAPPS_URI), doesn't it already fix the issue?