Make http client for token-feching configurable.

Make it `Config` level. Export the field and remove the setter. https://github.com/golang/oauth2/issues/27#issuecomment-53448348

Do it for JWTConfig and more importantly App Engine implementation.

While you are there, I'd prefer you add a `Transport` as well.