GCP OIDC proxy credentials signer

main.py

_adc_credentials, _ = google.auth.default(scopes=[IAM_SCOPE])

# For service accounts using the Compute Engine metadata service, which is the
# case for Cloud Function service accounts, service_account_email isn't
# available until refresh is called.
_adc_credentials.refresh(GRequest())

# Since the Compute Engine metadata service doesn't expose the service
# account key, we use the IAM signBlob API to sign instead. In order for this
# to work, the Cloud Function's service account needs the "Service Account
# Actor" role.
_signer = iam.Signer(
    GRequest(), _adc_credentials, _adc_credentials.service_account_email)