fix: do not use the GAE APIs on gen2+ runtimes

[zevdg]

Currently, this library uses the App Engine credentials in all environments if
the APIs can be imported successfully. This assumption made sense when
the API was only available on gen1, but this is no longer the case.
See https://github.com/GoogleCloudPlatform/appengine-python-standard

In order to comply with AIP-4115, we must treat GAE gen2+ as a "compute
engine equivalent environment" even if the GAE APIs are importable.
In other words, google.auth.default() should not return an
app_engine.Credental on GAE gen2+.

[zevdg]

It's worth noting that this change could be disruptive if a user migrates their app from GAE gen1 to GAE gen2 with a version of google.auth that doesn't include this change. Then, instead of the ADC changing when they upgrade runtimes as the spec dictates, their ADC would change when they upgrade this library to include this change. As such, any migration guides should encourage users to upgrade this library to the latest py2-compatible version BEFORE migrating to gen2.

Conversely, if we do not make this change, then gen2 users could run into the opposite problem. Their ADC could suddenly start returning an app_engine.Credential instead of a compute_engine.Credential if they (or one of their dependencies) adds appengine-python-standard to their requirements.txt.

The sooner we land this change, the less people will be affected by either of those scenarios.

[busunkim96]

CC @wescpy and @engelke since they're listed as DevRel contacts for this project.

Asking folks to update to a minimum version of google-auth is captured in a comment in a documentation bug (186268245).

[arithmetic1728]

@zevdg Kokoro build failed because coverage test failed. It seems we need some additional unit tests to cover google/auth/_default.py line 243-245 and 251-255.

[gcf-merge-on-green]

Merge-on-green attempted to merge your PR for 6 hours, but it was not mergeable because either one of your required status checks failed, one of your required reviews was not approved, or there is a do not merge label. Learn more about your required status checks here: https://help.github.com/en/github/administering-a-repository/enabling-required-status-checks. You can remove and reapply the label to re-run the bot.