While service account impersonation is uncommonly used with workforce
pool external credentials, there is a bug where the following commands
raise exceptions when impersonated workforce pools are used:

- `google.auth.default()`
- `google.auth.load_credentials_from_file()`

The issue is due to `google.auth.aws.Credentials` not supporting the
`workforce_pool_user_project` argument in the constructor, unlike
`google.auth.identity_pool.Credentials`.

This was indirectly passed here:
https://github.com/googleapis/google-auth-library-python/blob/a37ff00d7afd6c7aac2d0fab29e05708bbc068be/google/auth/external_account.py#L395
Causing a TypeError to be raised (we only catch ValueError).

Updated the credential determination logic to explicitly check the
subject token type. This is a more reliable indicator instead of a
try/catch.

Increased unit test coverage in tests/test__default.py to cover these
credentials.

…le (#881)

* build: use trampoline_v2 for python samples and allow custom dockerfile

Source-Link: googleapis/synthtool@a7ed11e
Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:6e7328583be8edd3ba8f35311c76a1ecbc823010279ccb6ab46b7a76e25eafcc

* chore: add trampolinerc

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
Co-authored-by: Bu Sun Kim <busunkim@google.com>

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>