Introduce simplified Default credential provision

As the first step in credential consolidation, we replace
injection of application default credential in for KMS and
Drive.

Tests:
- for Drive, tested with exportDomainLists and exportReservedTerms.
- For KMS, used CLI commands (get_keyring_secret and update_kms_keyring) to change and
  restore secret for one key.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=211819859

java/google/registry/config/RegistryConfigSettings.java

@@ -22,6 +22,7 @@ public class RegistryConfigSettings {
   public AppEngine appEngine;
   public GSuite gSuite;
   public OAuth oAuth;
+  public CredentialOAuth credentialOAuth;
   public RegistryPolicy registryPolicy;
   public Datastore datastore;
   public CloudDns cloudDns;
@@ -48,13 +49,18 @@ public class RegistryConfigSettings {
     }
   }
 
-  /** Configuration options for OAuth settings. */
+  /** Configuration options for OAuth settings for authenticating users. */
   public static class OAuth {
     public List<String> availableOauthScopes;
     public List<String> requiredOauthScopes;
     public List<String> allowedOauthClientIds;
   }
 
+  /** Configuration options for accessing Google APIs. */
+  public static class CredentialOAuth {
+    public List<String> credentialOauthScopes;
+  }
+
   /** Configuration options for the G Suite account used by Nomulus. */
   public static class GSuite {
     public String domainName;