feat: add custom scopes for access tokens from the metadata service

[davidwtbuxton]

This works for App Engine, Cloud Run and Flex. On Compute Engine you
can request custom scopes, but they are ignored.

Part of #579

I will create a separate PR to update the user guide, which has been out-of-date for a while.

https://google-auth.readthedocs.io/en/latest/user-guide.html#compute-engine-container-engine-and-the-app-engine-flexible-environment

I've tested this on App Engine standard and Cloud Run, and using google.auth.default(scopes=..) works now. I tested on Compute Engine and requesting scopes has no effect, but does not raise an exception (which is expected).

Failing unit tests.

[davidwtbuxton]

Thanks for looking at this PR @tseaver

Tests are failing because of #632 , which impacts the head of master too. They would start passing again if pnuckowski/aioresponses#174 is accepted and a new release of aioresponses is published on PyPI.

[tseaver]

PR #634 fixes the unit tests on `master. I've merged to see if this PR will then pass.

[silvolu]

Auth bits looks good. Nice to see you again @tseaver :)

[gcf-merge-on-green]

Your PR has attempted to merge for 3 hours. Please check that all required checks have passed, you have an automerge label, and that all your reviewers have approved the PR

[gcf-merge-on-green]

Merge-on-green attempted to merge your PR for 6 hours, but it was not mergeable because either one of your required status checks failed, or one of your required reviews was not approved. Learn more about your required status checks here: https://help.github.com/en/github/administering-a-repository/enabling-required-status-checks. You can remove and reapply the label to re-run the bot.

[gcf-merge-on-green]

Merge-on-green attempted to merge your PR for 6 hours, but it was not mergeable because either one of your required status checks failed, or one of your required reviews was not approved. Learn more about your required status checks here: https://help.github.com/en/github/administering-a-repository/enabling-required-status-checks. You can remove and reapply the label to re-run the bot.