fix: Add scope for Credentials

[ttosta-google]

The OAuth scopes should be set for the credentials.

When the scopes are missing, the following error is seeing (from GoogleCloudPlatform/spring-cloud-gcp#2788):

Caused by: com.google.auth.oauth2.GoogleAuthException: Error getting access token for service account: 400 Bad Request
POST https://oauth2.googleapis.com/token
***"error":"invalid_scope","error_description":"Invalid OAuth scope or ID token audience provided."***, iss: [email protected]
	at com.google.auth.oauth2.GoogleAuthException.createWithTokenEndpointResponseException(GoogleAuthException.java:129)
	at com.google.auth.oauth2.ServiceAccountCredentials.refreshAccessToken(ServiceAccountCredentials.java:538)
	at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:270)
	at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:267)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at com.google.auth.oauth2.OAuth2Credentials$RefreshTask.run(OAuth2Credentials.java:635)
	at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:31)
	at com.google.auth.oauth2.OAuth2Credentials$AsyncRefreshResult.executeIfNew(OAuth2Credentials.java:582)
	at com.google.auth.oauth2.OAuth2Credentials.asyncFetch(OAuth2Credentials.java:233)
	at com.google.auth.oauth2.OAuth2Credentials.refreshIfExpired(OAuth2Credentials.java:204)
	at com.google.cloud.alloydb.DefaultAccessTokenSupplier.getTokenValue(DefaultAccessTokenSupplier.java:55)
	at com.google.cloud.alloydb.ConnectionSocket.metadataExchange(ConnectionSocket.java:234)

[jackwotherspoon]

Is this a new requirement for the metadata exchange?

None of our other repos are currently adding the login scope? Python Connector

[ttosta-google]

The login scope is really only used for IAM Authentication. So it was removed for now.

[jackwotherspoon]

So we haven't been adding the cloud-platform scope to credentials this entire time? How has the Connector been working then?

[enocom]

This is a detail of the Java credentials library AFAIK. In some situations, the cloud platform scope must be added implicitly.

Meanwhile, the token scope isn't strictly required for IAM Authn.