Add support for GCP_OAUTH2_REFRESH_TOKEN env variable.

This addresses #8.

Also:
* Be more robust about detecting GCE service account scopes. (#5)
* Clarify different auth methods in README.md
You aren't confused.  @proppy and I are.  We chatted about this and I was naively applying lessons around not putting secrets into things like URLs (as they show up in history) or in command lines (as they show up in `ps` and `/proc`).  The command line in `docker ps` is inside the container (not the `docker run` command) and it does show up in `docker inspect`.  I'll change it back.