Infer project from credentials if not passed explicitly

[tseaver]

Split off from #17

See also: googleapis/python-datastore#74
See also: googleapis/python-storage#177

In a "blank slate" design, I would argue that the credentials' project should supersede the one present in the environment. However, for backward compatibility, we need to use the credentials' project only if the environment variable is not set. So the order should follow the pattern from google.auth.default when inferring project ID:

• Explicit project ID passed to client constructor
• Project ID set in GOOGLE_CLOUD_PROJECT envvar
• Project ID from credentials, if present
• Project ID from SDK
• Project ID from GAE
• Project ID from GCE

[tseaver]

In the case where credentials are discovered for us, google.auth.default() already falls back to the project in the credentials. E.g.:

$ unset GOOGLE_CLOUD_PROJECT GCLOUD_PROJECT
$ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service_account.json
$ grep project_id /path/to/service_account.json
    "project_id": "some-project-123"
$ python
>>> from google.auth import default
>>> credentials, project = default()
>>> project
'some-project-123'
>>> from google.cloud.client import ClientWithProject
>>> client = ClientWithProject()
>>> client.project
'some-project-123'

So, the case we need to cover for this feature is when the user has passed in explicit service account credentials, but not an explicit project ID, e.g. (this won't currently work):

$ unset GOOGLE_CLOUD_PROJECT GCLOUD_PROJECT GOOGLE_APPLICATION_CREDENTIALS
$ python
>>> from google.oauth2.service_account import Credentials
>>> credentials = Credentials.from_service_account_file("/path/to/service_account.json")
>>> from google.cloud.client import ClientWithProject
>>> client = ClientWithProject(credentials=credentials)  # currently raises