custom container credentials

I did not find a Jira ticket for this TODO, so I wanted to create one: [https://github.com/apache/beam/blob/master/sdks/python/apache_beam/runners/portability/fn_api_runner/worker_handlers.py#L757](https://github.com/apache/beam/blob/master/sdks/python/apache_beam/runners/portability/fn_api_runner/worker_handlers.py#L757)

This seems to affect PortableRunner. Without the ability to pass credentials to a container at runtime, e.g. GOOGLE_APPLICATION_CREDENTIALS, the credentials must be built into the container at build-time, which is not ideal (nor is this limitation documented, as far as I can tell)

Imported from Jira [BEAM-11680](https://issues.apache.org/jira/browse/BEAM-11680). Original Jira may contain additional context.
Reported by: tjwebb.google.