Generate id_token from default credentials

**Is your feature request related to a problem? Please describe.**

Currently, `google.auth.default()` generates `Credentials` that contain `.token` that is an access token.
We'd like to also generate `id_token` with the appropriate audience starting from default credentials.

This would allow us to submit requests that use `id_token` uniformly among different environments:
- Local Service Account key
- Cloud Functions
- Cloud Run
- App Engine
- GKE Workload Identity

**Describe the solution you'd like**

It would be great to add a method to `google.auth.credentials.Credentials` that allows `id_token` generation, e.g.
```py
credentials.id_token(audience='https://example.org')
```

**Describe alternatives you've considered**
So far, we had to rely on piece-meal approaches, like this example from https://github.com/apache/airflow/blob/master/airflow/providers/google/common/utils/id_token_credentials.py

This unnecessarily increases the complexity of third-party apps, and we have to re-implement the same logic in each one of them.

It would be preferable to incorporate such logic into this library instead.

**Additional context**