[google-auth-library-java] add validation to ensure ImpersonatedCredential can only be SA or User Credentials

This line in javadoc specifies ImpersonatedCredential can only be SA or User Credentials in this `create()` method, but it is not enforced.

https://github.com/googleapis/google-auth-library-java/blob/a8d466f3951686ddf0f6a7ae429cab505b337c54/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java#L120

For context: https://github.com/googleapis/google-auth-library-java/pull/1566#discussion_r1882521720

Start in oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java at the linked javadoc and create() method, then compare the documented credential types with the current behavior. Confirm how unsupported credentials should be rejected and check the relevant authentication tests; done means the implementation enforces the documented restriction.

Written by the indexing model from the issue text.