Description

This change applies a vulnerability mitigation (b/437993913).

The core issue is that generic credential loading methods like fromJSON() and fromStream() can be exploited. If an application accepts a credential configuration from an untrusted source, an attacker can craft a malicious JSON payload (e.g., with type: 'external_account'). This could cause the library to load a credential type that can exfiltrate data or tokens by interacting with attacker-controlled URLs.

To mitigate this, this PR:

1. Deprecates fromJSON() and fromStream() in GoogleAuth: These methods are now marked as deprecated, with detailed JSDoc comments explaining the security risk.
2. Guides Users to Safer Alternatives: The deprecation messages and README now guide users to use credential-specific constructors, such as new JWT(...) for service accounts. This approach is safer because it requires the developer to be explicit about the credential type they intend to use, preventing the library from dynamically loading a potentially malicious type based on external input.
3. Adds Warnings to High-Risk Credentials: Explicit warnings have been added to the constructors of ExternalAccountClient and Impersonated to ensure users are aware of the risks when using these credential types with externally sourced configurations.
4. Deprecates Unsafe Constructor Options: The keyFilename and credentials options in the GoogleAuth constructor are now deprecated. These options promote an unsafe API pattern by allowing the library to implicitly determine the credential type from a generic file or object. Deprecating them enforces the recommended, more secure practice of explicitly creating a credential object of a specific type first before passing it to a client.

Impact

This is a non-breaking security enhancement. Existing code will continue to function, but users of the deprecated methods will see warnings encouraging them to adopt safer credential loading practices. This change hardens the library against potential credential mis-configuration attacks.

Testing

The changes primarily involve adding deprecation tags, JSDoc comments, and updating documentation. No core logic was altered. The existing test suite was run to ensure that all functionality remains intact and no regressions were introduced. All tests continue to pass.

Checklist

• b/437993913
• Ensure the tests and linter pass
• Code coverage does not decrease
• Appropriate docs were updated
• Appropriate comments were added, particularly in complex areas or
  places that require background
• No new warnings or issues will be generated from this change

Fixes b/437993913