fix: Differentiating explicitly loaded vs default credentials

[hiranya911]

Modules like Firestore and Storage used to have the following bit of code:

firebase-admin-node/src/firestore/firestore.ts

Lines 98 to 110 in 00892e0

	} else if (app.options.credential instanceof ApplicationDefaultCredential) {
	// Try to use the Google application default credentials.
	// If an explicit project ID is not available, let Firestore client discover one from the
	// environment. This prevents the users from having to set GOOGLE_CLOUD_PROJECT in GCP runtimes.
	return validator.isNonEmptyString(projectId) ? {projectId, firebaseVersion} : {firebaseVersion};
	}
	throw new FirebaseFirestoreError({
	code: 'invalid-credential',
	message: 'Failed to initialize Google Cloud Firestore client with the available credentials. ' +
	'Must initialize the SDK with a certificate credential or application default credentials ' +
	'to use Cloud Firestore API.',
	});

This allowed checking if the SDK was initialized with ADC, and if so delegating the credential loading back to the corresponding GCP library. In other cases (e.g. custom credentials), an error was thrown.

But in the v8.9.1 release this code was refactored into this:

firebase-admin-node/src/firestore/firestore.ts

Lines 88 to 100 in 5ce9175

	} else if (app.options.credential instanceof ComputeEngineCredential) {
	// Try to use the Google application default credentials.
	// If an explicit project ID is not available, let Firestore client discover one from the
	// environment. This prevents the users from having to set GOOGLE_CLOUD_PROJECT in GCP runtimes.
	return validator.isNonEmptyString(projectId) ? {projectId, firebaseVersion} : {firebaseVersion};
	}
	throw new FirebaseFirestoreError({
	code: 'invalid-credential',
	message: 'Failed to initialize Google Cloud Firestore client with the available credentials. ' +
	'Must initialize the SDK with a certificate credential or application default credentials ' +
	'to use Cloud Firestore API.',
	});

But this is not quite equivalent to the logic we used to have, because:

ApplicationDefaultCredential = 
  MetadataServiceCredential |
  RefreshTokenCredential loaded from well-known path |
  CertCredential loaded from environment variable

The new ComputeEngineCredential only accounts for the MetadataServiceCredential.

In order to cover the remaining 2 cases, we need to differentiate the credentials that were explicitly instantiated by the developer and the credentials that were implicitly loaded by the SDK. This PR implements this capability and updates the rest of the code that depends on this behavior.

Resolves #763

RELEASE NOTE: Fixed a credential loading issue that prevented some Cloud Functions from being deployed via the Firebase CLI.

[lahirumaramba]

LGTM