Add workaround for golang.org/x/oauth2/google panic

[espadolini]

Because of golang/oauth2#583, it's possible to get a panic when trying to use a Google JSON credential file, if it requires user interaction but the appropriate callback is not specified (see #15608).

This PR adds a callback that always returns an error, in that case.

[greedy52]

Is it possible to add a test case for this?

[espadolini]

It might be possible to change the way we parse credentials to properly error out if the credential file is not of service_account type (which is the only one that's intended to be supported anyway, as other credential types don't do impersonation as we expect them to). Holding off on merging this until I figure out if that's ok to do, as that would essentially negate the need for this while also improving the admin user experience.

[espadolini]

Closing in favor of #16003