This is the first part of implementing gRFC A97 (grpc/proposal#492).

Closes #39769

COPYBARA_INTEGRATE_REVIEW=#39769 from markdroth:jwt_token_call_creds fd890a3
PiperOrigin-RevId: 772533750

This is the first part of implementing gRFC A97 (grpc/proposal#492).

Closes grpc#39769

COPYBARA_INTEGRATE_REVIEW=grpc#39769 from markdroth:jwt_token_call_creds fd890a3
PiperOrigin-RevId: 772533750

…le call creds (#39772)

This is the second half of gRFC A97 (grpc/proposal#492).

Closes #39772

COPYBARA_INTEGRATE_REVIEW=#39772 from markdroth:jwt_token_call_creds2 727f770
PiperOrigin-RevId: 776233709

This is the first part of implementing gRFC A97 (grpc/proposal#492).

Closes grpc#39769

COPYBARA_INTEGRATE_REVIEW=grpc#39769 from markdroth:jwt_token_call_creds fd890a3
PiperOrigin-RevId: 772533750

…le call creds (grpc#39772)

This is the second half of gRFC A97 (grpc/proposal#492).

Closes grpc#39772

COPYBARA_INTEGRATE_REVIEW=grpc#39772 from markdroth:jwt_token_call_creds2 727f770
PiperOrigin-RevId: 776233709

…7) (#8431)

Part one for grpc/proposal#492 (A97). 
This is done in a new `credentials/jwt` package to provide file-based
PerRPCCallCredentials. It can be used beyond XDS. The package handles
token reloading, caching, and validation as per A97 .

There will be a separate PR which uses it in `xds/bootstrap`. 

Whilst implementing the above, I considered `credentials/oauth` and
`credentials/xds` packages instead of creating a new one. The former
package has `NewJWTAccessFromKey` and `jwtAccess` which seem very
relevant at first. However, I think the `jwtAccess` behaviour seems more
tailored towards Google services. Also, the refresh, caching, and error
behaviour for A97 is quite different than what's already there and
therefore a separate implementation would have still made sense.
WRT `credentials/xds`, it could have been extended to both handle
transport and call credentials. However, this is a bit at odds with A97
which says that the implementation should be non-XDS specific and, from
reading between the lines, usable beyond XDS.
I think the current approach makes review easier but because of the
similarities with the other two packages, it is a bit confusing to
navigate. Please let me know whether the structure should change.

Relates to istio/istio#53532

RELEASE NOTES:
- credentials: Add `credentials/jwt` package providing file-based JWT
PerRPCCredentials (A97).

)

Part two for grpc/proposal#492 (A97), following
#8431 .

What this PR does is:

- update `internal/xds/bootstrap` with support for loading multiple
PerRPCCallCredentials specifed in a new `call_creds` field in the
boostrap file as per A97
- adjust `xds/internal/xdsclient/clientimpl.go`to use the call
credentials when constructing the client
- update `xds/bootstrap` to register the `jwtcreds` call credentials and
make them available if `GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS` is
enabled

Relates to istio/istio#53532


RELEASE NOTES:
- xds: add support for loading a JWT from file and use it as Call
Credentials (A97). To enable this feature, set the environment variable
`GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS` to `true` (case
insensitive).

…pc#8536)

Part two for grpc/proposal#492 (A97), following
grpc#8431 .

What this PR does is:

- update `internal/xds/bootstrap` with support for loading multiple
PerRPCCallCredentials specifed in a new `call_creds` field in the
boostrap file as per A97
- adjust `xds/internal/xdsclient/clientimpl.go`to use the call
credentials when constructing the client
- update `xds/bootstrap` to register the `jwtcreds` call credentials and
make them available if `GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS` is
enabled

Relates to istio/istio#53532


RELEASE NOTES:
- xds: add support for loading a JWT from file and use it as Call
Credentials (A97). To enable this feature, set the environment variable
`GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS` to `true` (case
insensitive).