feat: add ID tokens for user refresh credentials

[bshaffer]

Add ID token support to UserRefreshCredentials

• add tests
• manual E2E test to verify it works

Manually tested by running gcloud auth application-default login, and then executing the following:

use Google\Auth\ApplicationDefaultCredentials;
use GuzzleHttp\Client;
use GuzzleHttp\Psr7\Request;
use Firebase\JWT\JWK;
use Firebase\JWT\JWT;

// Get the UserRefreshCredentials from "~/.config/gcloud/application_default_credentials.json",
// and supply the target audience
$credentials = ApplicationDefaultCredentials::getIdTokenCredentials('test-target-audience');
$idToken = $credentials->fetchAuthToken();

// Verify the ID token using the certs from Google
$certUrl = 'https://www.googleapis.com/oauth2/v3/certs';
$client = new GuzzleHttp\Client();
$certs = json_decode($client->send(new Request('GET', $certUrl))->getBody(), true);

$keys = JWK::parseKeySet($certs);
$decoded = JWT::decode($idToken['id_token'], $keys);
var_dump($decoded);

see also googleapis/google-auth-library-nodejs#1811

[Hectorhammett]

file_get_contents can return a false value on error. Should we take that into consideration?

[bshaffer]

yes, that's a good point... maybe it should be file does not exist or is unreadable instead

[Hectorhammett]

It might be my non native brain but this reads weird to me.
Scope and targetAudience cannot be supplied at the same time

But might be just me though.