auth: support providing custom certificate URLs

[idhame]

This feature has been requested before in googleapis/google-api-go-client#640

The current documentation for Google Chat bot verification shows

If the Authentication Audience field of the Chat app connection setting is set to Project Number, the bearer authorization token in the request is a self-signed JSON Web Token (JWT), issued and signed by [email protected]. The audience field is set to the Google Cloud project number that you used to build your Chat app. For example, if your Chat app's Cloud project number is 1234567890, then the audience field in the JWT is 1234567890.

In their code examples they show that the url to get the certs for validation should be https://www.googleapis.com/service_accounts/v1/metadata/x509/[email protected]

As of now the auth package doesn't support the kind of JWT validation specified in the docs.

[idhame]

hi @quartzmo, can you review my PR #11006 related to this feature request ? thanks!