Support channel call-credential hook for xDS transport

[choonkijang]

Feature Request

Crates

• xds-client
• tonic-xds

Motivation

There is no way to attach per-stream call credentials (e.g. a bearer token) to the ADS stream. This blocks connecting to credential-gated control planes; GCP Traffic Director, whose bootstrap uses channel_creds: [{ "type": "google_default" }] and requires an Application Default Credentials (ADC) bearer token on the stream, over system-root TLS.

Related specification: gRFC A27 # XdsClient and Bootstrap File

Proposal

Briefly, mirror grpc-go's implementation

• https://github.com/grpc/grpc-go/blob/master/xds/bootstrap/credentials.go
• https://github.com/grpc/grpc-go/blob/master/xds/bootstrap/bootstrap.go

More specifically,

1. Define CallCredentials trait type, and let TonicTransportBuilder can take it (eg, with_call_credentials(Arc<dyn CallCredentials>)
2. Extend ChannelCredentialType to have google_default entry to follow gRFC A27.

Alternatives

• To be fully contained for gRFC A27, bring google_cloud_auth dependency just like grpc-google crate.

[choonkijang]

This is part of overall xDS support.

[choonkijang]

@gu0keno0 @YutaoMa would you please take a look at this issue and #2705? Thanks in advance!