Move generate_signed_url to standalone function in credentials.

Co-authored-by: Anthonios Partheniou <[email protected]>

* feat: add support for directly attached and effective tags
docs: clarify comments for tags and effective tags

Clients can search resources filtered by effective tags and start to use the new `tags` field instead of old `tag_key`, `tag_value`, `tag_value_id` fields to access directly attached tags.

PiperOrigin-RevId: 567554529

Source-Link: googleapis/googleapis@1a3ea87

Source-Link: googleapis/googleapis-gen@df4f7ba
Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiZGY0ZjdiYTQxYTgwN2ExOTNiNDhhZmRiYThkNGFlZjM1NjM2ODc1YSJ9

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

---------

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

* feat: refreshes Bigtable Admin API(s) protos

PiperOrigin-RevId: 448988001

Source-Link: googleapis/googleapis@b6fa58e

Source-Link: googleapis/googleapis-gen@fc8b8db
Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiZmM4YjhkYmM3ZGExYTc4NDVkNTcxMzRmNDExMzAyZDEwNmVhMmVmMiJ9

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Implement the two mtls env variables mentioned in https://google.aip.dev/auth/4114

New behavior summary:
(1) GOOGLE_API_USE_CLIENT_CERTIFICATE env variable:
Values:
"true": use client cert if exists
"false" (default): never use client cert, even if it exists or it is explicitly provided by user
(2) GOOGLE_API_USE_MTLS_ENDPOINT env variable:
Values:
"never": use regular endpoint
"always": use mtls endpoint
"auto" (default): auto switch to mtls endpoint, if client cert exists and we are allowed to use it (controlled by GOOGLE_API_USE_CLIENT_CERTIFICATE)

Source-Link: googleapis/synthtool@1b9ad76
Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:9db98b055a7f8bd82351238ccaacfd3cda58cdf73012ab58b8da146368330021

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

* fix: make nested retry blocks work for RPC calls
fixes #567

* fix: use special retry exception to return flow to outer retry block

Co-authored-by: Andrew Gorcester <[email protected]>

Source-Link: googleapis/synthtool@1b9ad76
Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:9db98b055a7f8bd82351238ccaacfd3cda58cdf73012ab58b8da146368330021

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

* This patch for </issues/501> includes the following fixes:

- The access token is always set to `None`, so the fix involves using (the access) `token` from the saved JSON credentials file.
- For refresh needs, `expiry` also needs to be saved via `to_json()`.
    - DUMP: As `expiry` is a `datetime.datetime` object, serialize to `datetime.isoformat()` in the same [`oauth2client` format](https://github.com/googleapis/oauth2client/blob/master/oauth2client/client.py#L55) for consistency.
    - LOAD: Add code to restore `expiry` back to `datetime.datetime` object when imported.
    - LOAD: If `expiry` was unsaved, automatically set it as expired so refresh takes place.
- Minor `scopes` updates
    - DUMP: Add property for `scopes` so `to_json()` can grab it
    - LOAD: `scopes` may be saved as a string instead of a JSON array (Python list), so ensure it is Sequence[str] when imported.