Service account is able to use a private token endpoint #809
Description
In some scenarios users can use an endpoint which is private to their VPC network. The request is eventually routed to the oauth2.googleapis.com/token so the "aud" in the assertion still should be oauth2.googleapis.com/token.
After this change, service account can send requests to the private endpoint (if configured) and still use the oauth2.googleapis.com/token in the assertion.
Same feature in Python for more details: googleapis/google-auth-library-python#784