ENH: Clear authentication defaults with more fine-grained control

We have about 220 lines of code which handles authentication - do we need that? Generally the answer to “do we need something we do a lot of” is ‘Yes’, but asking regardless

My prior is that we could:

1. Check if creds are passed by the user
2. Otherwise pass nothing through to the Google libraries, and let them manage the defaults

That would reduced the code we needed to maintain and conform to standards - Google have very reasonable defaults, and we make it harder for those to flow through - e.g. PANDAS_GBQ_CREDENTIALS_FILE is non-standard, every other implementation uses GOOGLE_APPLICATION_CREDENTIALS, so users need to have an additional setting to use this library

[tswast]

I definitely think there is room for improvement here. My ideal flow would be:

1. Use credentials as explicitly passed by the user.
   • Passing in the bytes of the JSON file as currently done for backwards compatibility.
   • Passing in a Credentials object from google-auth.
2. Try to load cached user-auth credentials.
3. Use service account from PANDAS_GBQ_CREDENTIALS_FILE env var. (Should we keep doing this?)
4. Try to create default credentials using google-auth.
5. Do three-legged OAuth to get user credentials.

Note that google-auth default credentials does not do three-legged OAuth, so I think that’s an area where pandas-gbq will need to keep some auth code around.

Edit: Swapped items (1) and (2) so that explicitly passed credentials are always used first. Also, current behavior does default credentials before PANDAS_GBQ_CREDENTIALS_FILE. If we keep PANDAS_GBQ_CREDENTIALS_FILE around, we should prefer it to default credentials.

[tswast]

I have fleshed out a design that accounts for this feedback at #161. Closing this issue as a duplicate of that proposal.