auth: handle ENOTDIR when opening cert config

Some users explicitly have their home directories set to `/dev/null`.
When opening a file that's "under that directory", instead of getting
the normal `ENOENT`, one should expect to get `ENOTDIR`.

Unfortunately, due to the variety of cases under which `ENOTDIR` is
returned, the go team has declined to include ENOTDIR in `ErrNotExist`.
(https://golang.org/issues/18974)

This leaves explicitly testing for `ENOTDIR`, which (fortunately)
appears to be one of two errnos that are defined in the `syscall`
package for windows as well as all *nix platforms.

resolves: googleapis#10696

auth/internal/transport/cert/secureconnect_cert.go

@@ -25,6 +25,7 @@ import (
 	"os/user"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"time"
 )
 
@@ -62,7 +63,7 @@ func NewSecureConnectProvider(configFilePath string) (Provider, error) {
 
 	file, err := os.ReadFile(configFilePath)
 	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
+		if errors.Is(err, os.ErrNotExist) || errors.Is(err, syscall.ENOTDIR) {
 			// Config file missing means Secure Connect is not supported.
 			return nil, errSourceUnavailable
 		}

auth/internal/transport/cert/secureconnect_cert_test.go

@@ -30,6 +30,16 @@ func TestSecureConnectSource_ConfigMissing(t *testing.T) {
 	}
 }
 
+func TestSecureConnectSource_ConfigNotDirMissing(t *testing.T) {
+	source, err := NewSecureConnectProvider("/dev/null/missing.json")
+	if got, want := err, errSourceUnavailable; !errors.Is(err, errSourceUnavailable) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+	if source != nil {
+		t.Errorf("got %v, want nil source", source)
+	}
+}
+
 func TestSecureConnectSource_GetClientCertificateSuccess(t *testing.T) {
 	source, err := NewSecureConnectProvider("testdata/context_aware_metadata.json")
 	if err != nil {