fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder. (#3651)

@rockspore pointed out that the credential should be created from scratch because when using [toBuilder](https://github.com/googleapis/google-auth-library-java/blob/main/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java#L648) the underlying [access token is copied](https://github.com/googleapis/google-auth-library-java/blob/37d228410e99799e4a7be8650fe472ea712c9b4d/oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java#L657). This was confirmed to be a bug with local testing which: - deployed a GAE app, the app performs the below two actions sequentially - create Google API client ( `allowedHardBoundAccessTokens` empty in GrpcProvider) and then ping the API, logs show the bearer token is used, obtained from making call to MDS - create a Google API client ( `allowedHardBoundAccessTokens` contains `MTLS_S2A` in GrpcProvider) and then ping the API, logs show the bearer token is used. A call to MDS is **not** made. This is likely because the credential and channel have different lifetimes.

Author: rmehta19

gax-java/gax-grpc/src/main/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProvider.java

@@ -1200,11 +1200,20 @@ boolean isDirectPathBoundTokenEnabled() {
  CallCredentials createHardBoundTokensCallCredentials(
  ComputeEngineCredentials.GoogleAuthTransport googleAuthTransport,
  ComputeEngineCredentials.BindingEnforcement bindingEnforcement) {
+ ComputeEngineCredentials.Builder credsBuilder =
+ ((ComputeEngineCredentials) credentials).toBuilder();
  // We only set scopes and HTTP transport factory from the original credentials because
- // only those are used in gRPC CallCredentials to fetch request metadata.
+ // only those are used in gRPC CallCredentials to fetch request metadata. We create a new
+ // credential
+ // via {@code newBuilder} as opposed to {@code toBuilder} because we don't want a reference to
+ // the
+ // access token held by {@code credentials}; we want this new credential to fetch a new access
+ // token
+ // from MDS using the {@param googleAuthTransport} and {@param bindingEnforcement}.
  return MoreCallCredentials.from(
- ((ComputeEngineCredentials) this.credentials)
- .toBuilder()
+ ComputeEngineCredentials.newBuilder()
+ .setScopes(credsBuilder.getScopes())
+ .setHttpTransportFactory(credsBuilder.getHttpTransportFactory())
  .setGoogleAuthTransport(googleAuthTransport)
  .setBindingEnforcement(bindingEnforcement)
  .build());