Soft-warn about application default credentials using gcloud credentials

[JustinBeckwith]

Due to user issues with quota and API enablement, the auth libraries should issue a soft warning (that can be silenced) when application default credentials uses user credentials from the Cloud SDK. They should not warn if the credentials for the cloud sdk are service account credentials.

Your application has authenticated using end user credentials from Google 
Cloud SDK. We recommend that most server applications use service accounts
 instead. If your application continues to use end user credentials from Cloud 
SDK, you might receive a "quota exceeded" or "API not enabled" error. For 
more information about service accounts, see 
https://cloud.google.com/docs/authentication/.

Additional context:
https://groups.google.com/a/google.com/forum/#!topic/client-auth-team/DKqrFw6lL1Q
https://buganizer.corp.google.com/issues/64388723
googleapis/google-auth-library-python#266

[tmatsuo]

I feel like the best place to fix this issue is to change how gcloud auth application-default works.
If gcloud creates a service account and store the key securely (which is technically possible at all), the issue will just go away.

In other words, simple comparison between 8 engineers working on 8 auth libs and aforementioned central fix. WDYT?

[JustinBeckwith]

@theacodes has much of the context on the why here :) . Same in the thread.

[theacodes]

@tmatsuo while that might be viable, neither us or the cloud SDK team want to continue intertwining Cloud SDK configuration with API Client Library configuration.

Happy to chat more about this internally, but this is the decision that's been made with very careful consideration.

[JustinBeckwith]

gentle bump