internal/auth: use the idtoken package

The google.golang.org/api/idtoken package is the official way to
create identity tokens for accessing IAP-protected services. Change
internal/auth to use it.

It's now possible to call NewClient or Header with no credentials.
The idtoken package can construct credentials from the application
default, if it is a service account. That will be the case when
running on AppEngine.

What this means is that AppEngine services that need to talk to other
AppEngine services, like the prober, no longer need to get creds in
any special way (like storing the a service account's creds in a
secret, as the prober currently does); they can use their default
credentials for the AppEngine service account. All that is needed is
to grant the AppEngine service account the permission to access other
AppEngine services via the IAP, which has been done on our project.

Calling with credentials behaves as before; the idtoken package does
the same thing that our custom code was doing (more or less).

Other changes:

- Changed the signature of NewClient and Header to take a context.
- Removed the TokenSource method, which was unused.

For b/167586656

Change-Id: I90a5682e5ae59238b5ba00212aa5a057c4222553
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/252837
Reviewed-by: Julie Qiu <julie@golang.org>

0 files changed, 0 insertions, 0 deletions