support for "sub" parameter in JWT assertions

This pull request adds support for a `:sub` parameter needed for some Google Directory APIs.

Recently I tried to use the Signet client in conjunction with the [google-api-client](https://github.com/google/google-api-ruby-client) library to use a service account to query information from the following scope of the Google Directory API to read information about group membership for a user:

    https://www.googleapis.com/auth/admin.directory.group

When I did this, I got a 403 error and the following message: "Not Authorized to access this resource/api".   After doing some research, I found a ["sub" parameter](http://stackoverflow.com/questions/19908232/what-is-the-proper-way-to-authenticate-with-google-to-use-google-directory-api-i) that looks like it might be undocumented.  I have seen it neither in the [OAuth 2.0 documentation](https://developers.google.com/accounts/docs/OAuth2ServiceAccount) nor in the [documentation for the "get" command](https://developers.google.com/admin-sdk/directory/v1/reference/members/get) for the scope above, but when I use it with the email address of a super-user, the Directory API request succeeds.  The `:person` parameter (which maps to "prn") did not have any effect on queries to this scope.

The scope above does not require the `:sub` parameter if the request is being made using the Web flow using an account that has group-read permission.  I only needed it when using a service account.

I noticed that the the getters and setters in `lib/signet/oauth_2/client.rb` are explicitly defined, but I went ahead and used the equivalent and more idiomatic `attr_accessor` —  I hope this will be ok.  Commit `4d00942` is meant to be replaced with a suitable version bump.