feat(oauth2): add support for external account workforce identity

[cuiy0006]

External account has two types of identities:

Workload Identity - 3rd party identities that represent a workload, the configs for this are all handled at a project level

Workforce Identity - 3rd party identities that represent a user, configs for this are handled at the org level

We already support Workload Identity. To support Workforce Identity, I added options userProject in the request header.

---

This change is 

[codecov]

Codecov Report

Attention: Patch coverage is 97.36842% with 2 lines in your changes missing coverage. Please review.

Project coverage is 93.28%. Comparing base (d5962f8) to head (e24a974).
Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...ternal/oauth2_external_account_credentials_test.cc	96.72%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #14800   +/-   ##
=======================================
  Coverage   93.27%   93.28%           
=======================================
  Files        2319     2319           
  Lines      208231   208290   +59     
=======================================
+ Hits       194230   194293   +63     
+ Misses      14001    13997    -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[dbolduc]

is there an integration test for workforce identity? Like something that would fail before this PR and succeed after it?

[cuiy0006]

is there an integration test for workforce identity? Like something that would fail before this PR and succeed after it?

There is a case under domian_universe, I will figure out how to create a workforce identity for integration test.