Is your feature request related to a problem? Please describe.

Currently, google.auth.default() generates Credentials that contain .token that is an access token.
We'd like to also generate id_token with the appropriate audience starting from default credentials.

This would allow us to submit requests that use id_token uniformly among different environments:

• Local Service Account key
• Cloud Functions
• Cloud Run
• App Engine
• GKE Workload Identity

Describe the solution you'd like

It would be great to add a method to google.auth.credentials.Credentials that allows id_token generation, e.g.

credentials.id_token(audience='https://example.org')

Describe alternatives you've considered
So far, we had to rely on piece-meal approaches, like this example from https://github.com/apache/airflow/blob/master/airflow/providers/google/common/utils/id_token_credentials.py

This unnecessarily increases the complexity of third-party apps, and we have to re-implement the same logic in each one of them.

It would be preferable to incorporate such logic into this library instead.

Additional context