Populate HttpHeaders fields with List<String> instead of String.

HttpHeaders.putAll uses reflective access. Well-known headers such as
Content-Type or Authentication have dedicated fields of type List<String>,
while remaining headers go into a Map<String, Object> grab bag. The
IdentityPoolCredentials#getSubjectTokenFromMetadataServer method attempts
to set every header to a String, which causes a crash for well-known headers.

See bazelbuild/bazel#15639 for where this issue
was first noticed.

oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

@@ -51,7 +51,9 @@
 import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import javax.annotation.Nullable;
@@ -84,7 +86,7 @@ enum CredentialFormatType {
     private String credentialLocation;
 
     @Nullable private String subjectTokenFieldName;
-    @Nullable private Map<String, String> headers;
+    @Nullable private Map<String, List<String>> headers;
 
     /**
      * The source of the 3P credential.
@@ -124,7 +126,9 @@ enum CredentialFormatType {
       Map<String, String> headersMap = (Map<String, String>) credentialSourceMap.get("headers");
       if (headersMap != null && !headersMap.isEmpty()) {
         headers = new HashMap<>();
-        headers.putAll(headersMap);
+        for (Map.Entry<String, String> entry : headersMap.entrySet()) {
+          headers.put(entry.getKey(), Collections.singletonList(entry.getValue()));
+        }
       }
 
       // If the format is not provided, we expect the token to be in the raw text format.

oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java

@@ -679,6 +679,7 @@ static InputStream writeIdentityPoolCredentialsStream(
     GenericJson credentialSource = new GenericJson();
     GenericJson headers = new GenericJson();
     headers.put("Metadata-Flavor", "Google");
+    headers.put("Authorization", "Bearer token");
     credentialSource.put("url", url);
     credentialSource.put("headers", headers);
 
@@ -695,6 +696,7 @@ private static IdentityPoolCredentialSource buildUrlBasedCredentialSource(
     Map<String, Object> credentialSourceMap = new HashMap<>();
     Map<String, String> headers = new HashMap<>();
     headers.put("Metadata-Flavor", "Google");
+    headers.put("Authorization", "Bearer token");
     credentialSourceMap.put("url", url);
     credentialSourceMap.put("headers", headers);
     credentialSourceMap.put("format", formatMap);