feat: define `google.auth.downscoped.Credentials` class (#801)
* feat: define `google.auth.downscoped.Credentials` class
This is based on [Downscoping with Credential Access Boundaries](https://cloud.google.com/iam/docs/downscoping-short-lived-credentials).
The new credentials are initialized mainly using elevated source
credentials and a `google.auth.downscoped.CredentialAccessBoundary`
instance.
The credentials will then get access tokens from the source
credentials and exchange them via the GCP STS token exchange
endpoint using the provided credentials access boundary rules
for downscoped access tokens.
The new credentials will inherit the source credentials' scopes
but the scopes are not exposed as we cannot always determine the
scopes form the source credentials.
* Fixes typos in comments.
* Addresses review comments.
* Moves all constants in the test file to module scope.
2 files changed
