[query] Unify CloudCredentials and Simplify BatchClient

[ehigham]

This change combines cloud auth logic that was previously duplicated
between the various FS implementations and the BatchClient.

The main refactoring is to make the interface between the ServiceBackend more
high-level and leave json serialisation to the BatchClient. To do this, I've
added a bunch of case classes that resemble the python objects the batch service
expects (or a subset of the data). To simplify the interface, I've split batch
creation from job submission (update). For QoB, the python client creates the
batch before handing control to the query driver; batch creation is necessary
for testing only.

This change has low security impact as there are minor changes to the creation
and scoping of service account credentials. Note that for each FS, credentials
are scoped to the default storage oauth2 scopes for each service.

[ehigham]

• [query] Unify CloudCredentials and Simplify BatchClient #14684 : 2 dependent PRs (#14686 , #14747 ) 👈 (View in Graphite)
• [query] Use sourcecode.Enclosing to handle timed blocks implicitly #14683
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[patrick-schultz]

These are great changes! I'm very sorry again it took me so long to get through the review. I only have a few small questions/requests.