auth/credentials: add sentinel error for DetectDefault when no credentials are detected

## Motivation
In Config Sync, we have some code in one of our controllers that does different things depending on whether or not the K8s Deployment has configured authentication or not. For example, on AWS we still export Prometheus metrics, but disable Cloud Monitoring metrics.

To do this, we call `credentials.DetectDefault` and check for an error message that starts with `credentials: could not find default credentials.` This implies that credentials were not configured at all, so it can still surface other errors as configuration errors. https://github.com/googleapis/google-cloud-go/blob/auth/v0.12.1/auth/credentials/detect.go#L108

This case would be easier to detect and less fragile with a sentinel error.

## Proposed solution
The `credentials.DetectDefault` function could return a new sentinel error, named something like `CredentialsNotFoundError` when all detection methods are skipped. This would allow Config Sync to check for the sentinel error by type with `errors.Is`, instead of by error string prefix.

## Alternatives considered
To ensure that the code doesn't start failing in the future due to an error message text change, we tried to add tests to verify the `credentials.DetectDefault` error message, but found that while that's possible locally, there's no way to make `credentials.DetectDefault` produce the `credentials: could not find default credentials.` error when running in Prow on GKE/GCE, because `metadata.OnGCE()` will return true, and the `allowOnGCECheck` test variable is package local. This alternate feature has been requested before: https://github.com/googleapis/google-cloud-go/issues/4920.

If we could force-disable the OnGCE check, by setting an env var, like `GCE_METADATA_HOST=""`, that would also work for us, and help other use cases, like integration testing, but adding a sentinel error sounds easier and less risky.

Another potentially less risky option would be to add an option to `DetectOptions` to disable the `OnGCE` check. That way it wouldn't need to use an env var. Then we could set that in our tests and continue using the error string match.