fix: use auth DetectDefault over oauth2 FindDefaultCredentials

[jackwotherspoon]

The new Google auth library should be used over the old oauth2 library.

• DetectDefault should be used over the old FindDefaultCredentials to
  source ADC from the environment.
• TokenProvider should be used over the old TokenSource
• Use auth library's httptransport.NewClient to gain advantage of built-in universe domain checks

This will help fix certain non-GDU paths as FindDefaultCredentials does not support
self-signed JWTs.

Switching to the new auth library also allows us to remove some tricky
custom token refresh logic:

cloud-sql-go-connector/internal/cloudsql/refresh.go

Lines 143 to 162 in 3e8203a

	var expired = time.Time{}.Add(1)
	// canRefresh determines if the provided token was refreshed or if it still has
	// the sentinel expiration, which means the token was provided without a
	// refresh token (as with the Cloud SQL Proxy's --token flag) and therefore
	// cannot be refreshed.
	func canRefresh(t *oauth2.Token) bool {
	return t.Expiry.Unix() != expired.Unix()
	}
	// refreshToken will retrieve a new token, only if a refresh token is present.
	func refreshToken(ts oauth2.TokenSource, tok *oauth2.Token) (*oauth2.Token, error) {
	expiredToken := &oauth2.Token{
	AccessToken: tok.AccessToken,
	TokenType: tok.TokenType,
	RefreshToken: tok.RefreshToken,
	Expiry: expired,
	}
	return oauth2.ReuseTokenSource(expiredToken, ts).Token()
	}

Previously TokenSource tokens were tricked into performing a refresh by setting
the Expiry to one minute in the future. This was required as tokens were observed
to be cached sometimes up until <30s until expiry.

We no longer need this logic as the TokenProvider implementation by default
uses NewCachedTokenProvider which caches tokens and automatically refreshes
them when the token is close to expiring (within ~4 minutes).

Fixes #904

[jackwotherspoon]

@quartzmo mind taking a quick pass and letting me know if this looks okay to you? 😄

[enocom]

LGTM.

Will you add a few sentences about why we're not force refreshing the token anymore? That was a tricky piece of code to write, but is now obviated by the better caching period in the new auth library. We're definitely going to forget this, so recording it for posterity would be a cheap and useful thing to do.

[quartzmo]

What do you think about converting this test setup to use DetectDefault instead of DefaultTokenSource at this time as well?

[jackwotherspoon]

@quartzmo I think you accidentally pasted the wrong link, not sure exactly what test you are referring to...

I do plan to eventually remove the rest of the test usage of TokenSource and add a message to the WithTokenSource option

What do you think about converting this test setup to use DetectDefault instead of DefaultTokenSource at this time as well?