Add support for GCP_OAUTH2_REFRESH_TOKEN env variable.

This addresses #8.

Also:
* Be more robust about detecting GCE service account scopes. (#5)
* Clarify different auth methods in README.md
@jbeda was the extra `.` after `google.internal` intentional?