auth/clientcredentials: add schema-based scope enforcement interceptor

[bobheadxi]

Adds an interceptor, clientcredentials.Interceptor, that enforces required SAMS scopes based on a proto schema extension. This will reduce boilerplate in RPC implementations and reduce the chance of mistakes/out-of-sync problems between a schema and the implementation

Usage example:

extend google.protobuf.MethodOptions {
	// The SAMS scopes required to use this RPC.
	//
	// The range 50000-99999 is reserved for internal use within individual organizations
	// so you can use numbers in this range freely for in-house applications.
	repeated string sams_required_scopes = 50001;
}

Allows you to set required scopes as method options:

rpc GetUserRoles(GetUserRolesRequest) returns (GetUserRolesResponse) {
	option (sams_required_scopes) = "sams::user.roles::read";
};

This generates E_SamsRequiredScopes that can be used to point to where we can extract sams_required_scopes.

Test plan

Unit tests

[unknwon]

[unknwon]

I think:

1. Logging service-side errors here is non-actionable, after all this is client's problem to have insufficient scope.
2. The error returned to the client does not need to be opaque (no security concerns), and being explicit greatly help the client debug scope issues.

[bobheadxi]

Removed the log, and made the error non-opaque 👍