Repository: googleapis/google-auth-library-python

Issue:
impersonated_credentials.py should use UTC 
ID tokens had an issue where the `fromtimestamp` API was used instead of `utcfromtimestamp`.  Ref: https://github.com/googleapis/google-auth-library-python/issues/1323.

It appears that `impersonated_credentials.py` uses the same API, and is likely impacted by the same issue.

```
➜ rg "\.fromtimestamp" -g '!*test*'
google/auth/compute_engine/credentials.py
392:        return id_token, datetime.datetime.fromtimestamp(payload["exp"])

google/auth/impersonated_credentials.py
457:        self.expiry = datetime.fromtimestamp(jwt.decode(id_token, verify=False)["exp"])
```

`google/auth/impersonated_credentials.py` should be updated to use `utcfromtimestamp` instead of `fromtimestamp`.




Discussion:
I verified that this is failing as well:
```py
import google.auth
import google.auth.transport.requests
import google.auth.impersonated_credentials

# gcloud auth application-default login --impersonate-service-account=...
creds, _project_id = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
assert isinstance(creds, google.auth.impersonated_credentials.Credentials), "gcloud login with impersonated creds required"

request = google.auth.transport.requests.Request()
creds.refresh(request)
assert creds.token
assert not creds.expired

id_creds = google.auth.impersonated_credentials.IDTokenCredentials(creds, 'foo', include_email=True)
id_creds.refresh(request)
assert id_creds.token
assert not id_creds.expired
```

Same as in #1323, with `export TZ=America/New_York` the id token is considered expired immediately and the last assert fails.
And confirming that when I change the code to `utcfromtimestamp` then the test case passes.
Awesome ! @juzna since you've already done all the hard work, do you want to open a PR for this? :)

If not I will, and will give you credit

Resolving patch:
diff --git a/google/auth/impersonated_credentials.py b/google/auth/impersonated_credentials.py
--- a/google/auth/impersonated_credentials.py
+++ b/google/auth/impersonated_credentials.py
@@ -454,4 +454,6 @@ def refresh(self, request):
 
         id_token = response.json()["token"]
         self.token = id_token
-        self.expiry = datetime.fromtimestamp(jwt.decode(id_token, verify=False)["exp"])
+        self.expiry = datetime.utcfromtimestamp(
+            jwt.decode(id_token, verify=False)["exp"]
+        )


Test patch:
diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
--- a/tests/test_impersonated_credentials.py
+++ b/tests/test_impersonated_credentials.py
@@ -488,7 +488,7 @@ def test_id_token_success(
         id_creds.refresh(request)
 
         assert id_creds.token == ID_TOKEN_DATA
-        assert id_creds.expiry == datetime.datetime.fromtimestamp(ID_TOKEN_EXPIRY)
+        assert id_creds.expiry == datetime.datetime.utcfromtimestamp(ID_TOKEN_EXPIRY)
 
     def test_id_token_metrics(self, mock_donor_credentials):
         credentials = self.make_credentials(lifetime=None)
@@ -512,7 +512,7 @@ def test_id_token_metrics(self, mock_donor_credentials):
                 id_creds.refresh(None)
 
                 assert id_creds.token == ID_TOKEN_DATA
-                assert id_creds.expiry == datetime.datetime.fromtimestamp(
+                assert id_creds.expiry == datetime.datetime.utcfromtimestamp(
                     ID_TOKEN_EXPIRY
                 )
                 assert (
@@ -581,7 +581,7 @@ def test_id_token_with_target_audience(
         id_creds.refresh(request)
 
         assert id_creds.token == ID_TOKEN_DATA
-        assert id_creds.expiry == datetime.datetime.fromtimestamp(ID_TOKEN_EXPIRY)
+        assert id_creds.expiry == datetime.datetime.utcfromtimestamp(ID_TOKEN_EXPIRY)
         assert id_creds._include_email is True
 
     def test_id_token_invalid_cred(