fix(option): Having both a TokenSource and Scopes should fail validation

If both ds.TokenSource and ds.Scopes are set, then an error will be returned as Scopes will be ignored

Fixes googleapis#1644

internal/settings.go

@@ -107,6 +107,9 @@ func (ds *DialSettings) Validate() error {
 	if len(ds.Scopes) > 0 && len(ds.Audiences) > 0 {
 		return errors.New("WithScopes is incompatible with WithAudience")
 	}
+	if len(ds.Scopes) > 0 && ds.TokenSource != nil {
+		return errors.New("WithScopes is incompatible with WithTokenSource")
+	}
 	// Accept only one form of credentials, except we allow TokenSource and CredentialsFile for backwards compatibility.
 	if nCreds > 1 && !(nCreds == 2 && ds.TokenSource != nil && ds.CredentialsFile != "") {
 		return errors.New("multiple credential options provided")