Use Google Identity Server to Generate JWT for Ambient Credentials

[irby]

This change set fixes an issue where the access token generated by using ambient credentials with GCP is not compatible with Command. The current code generates only an opaque access token, however Command requires the token be in JWT format.

Google's OAuth SDK does not expose a way to generate an OAuth access token in JWT format. Instead, the only way to produce a valid JWT signed by Google's OAuth server is by producing an ID token. The idtoken flow requires an audience. So, I've introduced a config value for audience that can be optionally set by the end user -- if not set, it will default the aud claim to command.

Because we are using an OIDC ID token instead of an OAuth access token, there are slight differences in the JWT produced. For example, the scopes provided will not appear in the JWT. However, end users can configure their Command instance to validate claims such as aud and email to assign identities to roles.