feat: add reauth feature to user credentials

[arithmetic1728]

googlers see: go/guac-python-reauth

This PR does 2 things:

1. Integrated google-reauth-python into google-auth library

Main APIs:

# API for getting rapt token
google.oauth2.reauth.get_rapt_token(request, client_id, client_secret, refresh_token, token_uri, scopes=None)

# API for refresh grant
google.oauth2.reauth.refresh_grant(request, token_uri, refresh_token, client_id, client_secret, scopes=None, rapt_token=None)

Supported challenge types: PASSWORD, SECURITY_KEY. To use SECURITY_KEY type, pyu2f dependency is required (either run pip install pyu2f or pip install google-auth[reauth].

2. Added reauth feature to user credentials (google.oauth2.credentials.Credentials)

If users opts in reauth (outside the scope of this lib), current google-auth version's refresh method will fail. With the added reauth feature, reauth flow will be triggered and the refresh method will work.
if users don't opt in reauth, then there is no difference w/o reauth feature because reauth won't be triggered.

Future PR will add reauth to async version of the credentials.

[busunkim96]

Is pyu2f owned by a team? It looks like it hasn't been touched since last October. https://github.com/google/pyu2f, https://github.com/google/pyu2f

[arithmetic1728]

Is pyu2f owned by a team? It looks like it hasn't been touched since last October. https://github.com/google/pyu2f, https://github.com/google/pyu2f

Yes gnubby team owns it.

[jay0lee]

Note that it doesn't seem like it's currently possible for GCP projects to enable the reauth API in the cloud console making it impossible to use reauth. See:

#742