xds bootstrap: enable using JWT Call Credentials (part 2 for A97)

[dimpavloff]

Part two for grpc/proposal#492 (A97). It's stacked on top of #8431

What this PR does is:

• update internal/xds/bootstrap with support for loading multiple PerRPCCallCredentials specifed in a new call_creds field in the boostrap file as per A97
• adjust xds/internal/xdsclient/clientimpl.goto use the call credentials when constructing the client
• update xds/bootstrap to register the jwtcreds call credentials and make them available if GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS is enabled

I have added DialOptionsWithCallCredsForTransport because, even though current and future call credentials are likely to all expect secure transport, I thought it would be safer to check of insecure transport just in case. If you prefer, I can just update DialOptions to use all call credentials regardless of the transport.

Relates to istio/istio#53532

RELEASE NOTES:

• xds bootstrap: add support for loading a JWT token from file and use it as Call Credentials (A97). This is guarded by GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS

[codecov]

Codecov Report

❌ Patch coverage is 93.50000% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.05%. Comparing base (b0bc6dc) to head (5673c18).

Files with missing lines	Patch %	Lines
internal/xds/bootstrap/bootstrap.go	88.88%	3 Missing and 1 partial ⚠️
credentials/jwt/jwt_token_file_call_creds.go	96.29%	2 Missing and 1 partial ⚠️
internal/xds/bootstrap/jwtcreds/bundle.go	88.88%	2 Missing and 1 partial ⚠️
xds/bootstrap/bootstrap.go	0.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8536      +/-   ##
==========================================
- Coverage   82.09%   82.05%   -0.05%     
==========================================
  Files         412      415       +3     
  Lines       40453    40652     +199     
==========================================
+ Hits        33211    33355     +144     
- Misses       5869     5919      +50     
- Partials     1373     1378       +5     

Files with missing lines	Coverage Δ
credentials/jwt/jwt_file_reader.go	100.00% <100.00%> (ø)
internal/xds/xdsclient/clientimpl.go	82.69% <100.00%> (+0.16%)	⬆️
xds/bootstrap/credentials.go	100.00% <100.00%> (ø)
credentials/jwt/jwt_token_file_call_creds.go	96.29% <96.29%> (ø)
internal/xds/bootstrap/jwtcreds/bundle.go	88.88% <88.88%> (ø)
xds/bootstrap/bootstrap.go	70.00% <0.00%> (-30.00%)	⬇️
internal/xds/bootstrap/bootstrap.go	67.70% <88.88%> (+2.17%)	⬆️

... and 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dimpavloff]

FYI, since the convention is to register the credentials via an init() function in xds/bootstrap/credentials.go, it's not possible to opt in or out of the registration there and at the same time to be able to unit test if the feature is guarded by XDSBootstrapCallCredsEnabled. Hence why the check has been moved here.