IAP service account certificate error

#### Environment details

- OS: MacOs/Google Cloud Functions
- Node.js version: 16
- npm version: 9.5.0
- `google-auth-library` version: 8.7.0

#### Steps to reproduce

1. Create an IAP
2. Create a client like [here](https://cloud.google.com/iap/docs/authentication-howto#obtaining_an_oidc_token_for_the_default_service_account), filling in your values

The idtoken will be fetched without issues. I also verified that the token works by using it in a curl request. However, the client throws the following error:

```
FetchError: request to https://my-protected-domain.com/mypage failed, reason: unable to verify the first certificate
at ClientRequest. (//node_modules/node-fetch/lib/index.js:1491:11)
at ClientRequest.emit (node:events:513:28)
at TLSSocket.socketErrorListener (node:_http_client:502:9)
at TLSSocket.emit (node:events:513:28)
at emitErrorNT (node:internal/streams/destroy:151:8)
at emitErrorCloseNT (node:internal/streams/destroy:116:3)
at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
type: 'system',
errno: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
...
```
It is interesting to note that this happens in the nodejs client and the python client, but not in the Golang client. For the python client, setting `verify=False` in the request solves the issue (in an insecure way).
The service account is verified by a keypair via the `GOOGLE_APPLICATION_CREDENTIALS` environment variable.
This happens both locally and in a cloud function.