Support universe_domain field from service account json file. The default value is "googleapis.com".

If the value is not default, then
(1) for access token, we will always use self signed jwt flow. Note that domain wide delegation is not supported, so if subject is provided we will throw exceptions.
(2) for id token, we will always use iamcredentials.generateIdToken endpoint. Note that iam.serviceAccountTokenCreator role is required to call this endpoint.