[google-auth-library-java] Investigate using ServiceAccountJwtAccessCredentials vs ServiceAccountCredentials

Issue stemmed from b/354698601

ServiceAccountJwtAccessCredentials may be setting the incorrect audience (not the default audience that is passed in to the Credentials). It may be using the URI for the http request instead of the shortened URI.

For example, the audience from this sample: https://cloud.google.com/bigquery/docs/json-web-tokens#java_example is `https://bigquery.googleapis.com/bigquery/v2/...` instead of `https://bigquery.googleapis.com/`. Previous attempts to use the shortened URI resulted in downstream failures in Spring-Cloud-GCP and java samples(see comments in https://github.com/googleapis/google-auth-library-java/pull/572).

Our guidance is to use ServiceAccountCredentials with SSJWT whenever possible.

## Scope
1. Investigate the use cases of ServiceAccountJwtAccessCredentials
2. Try to migrate any samples + recommendations of ServiceAccountJwtAccessCredentials to ServiceAccountCredentials with SSJWT
3. Try to patch ServiceAccountJwtAccessCredentials to use the correct audience

**edits:**
by @zhumin8 Minor corrections and provided more context links.

Start by comparing ServiceAccountJwtAccessCredentials with ServiceAccountCredentials and reviewing the BigQuery JSON Web Tokens Java sample. Read the linked google-auth-library-java pull request #572 for prior downstream failures. Done means the use cases and audience behavior are established, applicable samples and recommendations are addressed, and any needed credential change is validated.

由索引模型根据 Issue 内容生成。