xDS gRPC CallCredentials: support loading service account key from file system

Today when using a service account key as xDS gRPC call credentials, the content of the service account key needs to be included in Envoy bootstrap config. E.g.
```
grpc_services:
- google_grpc:
...
call_credentials:
service_account_jwt_access:
json_key:
token_lifetime_seconds: xxx
```
It would be better, if there is an option to keep service account key outside of bootstrap config in a file and reference the file path in bootstrap config.