Enterprise Certificate Proxy (https://github.com/googleapis/enterprise-certificate-proxy) is the new preferred solution for certificate based access on the client-side, since it integrates directly with the native OS keystores and does not expose the underlying private key. This new solution leverages the ECP client to replace the existing SecureConnect cert provider code-path for devices with the new ECP configuration file and helper binaries installed. (The ECP configuration file and helper binaries will eventually be distributed and managed through gCloud SDK).

High-level change-list summary:

- Refactored default_cert.go to split out SecureConnectSource into it's own file.
- Added EnterpriseCertificateProxySource, a new client certificate source that uses the ECP client.
- Updated tests and comments and added more test coverage.
- Updated go.mod to include the new dependency.

Note that this change is safe and backwards compatible, since the ECP configuration file will not be present on devices without ECP binaries installed, in which case the DefaultSource will fall back to using SecureConnect. Furthermore, both the new ECP code-path and the old SecureConnect code-path are gated behind the env-var GOOGLE_API_USE_CLIENT_CERTIFICATE today.

Adds invocation ID and attempt count to x-goog-api-client header
for simple and resumable uploads.

Note that this will also add this information to chunk upload
requests for individual chunks for BQ and other APIs that do uploads
using gensupport as well. Hopefully this isn't an issue.

Similar to googleapis/google-cloud-go#6013