feat: Implement Client-Side CAB token generation.

[huangjiahua]

Implement Client-Side CAB token generation.

• Temporarily added the staging repository for CEL with protobuf 3.25
• Add a new dependency tink for encryption.
• Will wait feat: Implement refreshCredentialsIfRequired for intermediate token r… #1583 to be merged first and resolve conflicts

---

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> ☕️

If you write sample code, please follow the samples format.

[nbayati]

Why do we need a synchronized block here?

[huangjiahua]

Since the value is written in a synchronized block:

google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java

Lines 298 to 307 in 0d96dcf

	synchronized (refreshLock) {
	try {
	this.intermediateCredentials = Futures.getDone(finishedTask);
	} finally {
	if (this.refreshTask != null && this.refreshTask.task == finishedTask) {
	this.refreshTask = null;
	}
	}
	}
	}

.

I'll update my code to use the refreshLock and the IntermediateCredentials wrapper.