Helper functions to get token from HTTPBearer, Session state key or credentials service

[bimission]

** Please make sure you read the contribution guide and file the issues in the right place. **
Contribution guide.

Is your feature request related to a problem? Please describe.
ADK works well when it controls OAUth flow. However when ADK agents gets access token from external system - there is no standardized way to get that token. Token can be passed through HTTP Bearer, Session State or Credentials Service. Having helper functions that would be used in auth_credential object to specify from where ADK should take the token would help

Describe the solution you'd like
A clear and concise description of what you want to happen.

auth_credential = AuthCredential(
auth_type=AuthCredentialTypes.OAUTH2,
oauth2=OAuth2Auth(
access_token=---->>>>>> HELPER <<<<<<<<<<<<< # Set the existing access token
)
)

auth_credential = AuthCredential(
auth_type=AuthCredentialTypes.OAUTH2,
oauth2=OAuth2Auth(
access_token=existing_access_token # Set the existing access token
)
)

Like:
auth_credential = AuthCredential(
auth_type=AuthCredentialTypes.OAUTH2,
oauth2=OAuth2Auth(
access_token=AuthHelper.GetHTTPBearer() # to dynamically get token from HTTP bearer at runtime
)
)

auth_credential = AuthCredential(
auth_type=AuthCredentialTypes.OAUTH2,
oauth2=OAuth2Auth(
access_token=AuthHelper.GetFromSessionStateKey(key_name) # to dynamically get from session state
)
)

auth_credential = AuthCredential(
auth_type=AuthCredentialTypes.OAUTH2,
oauth2=OAuth2Auth(
access_token=AuthHelper.GetCredentialsService(key_name) # to dynamically get from Credentials Service
)
)

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[davxiao]

+1

Also there is no clear mechanism in adk to allow the custom code to refresh the token when the token expires or when http is returning code that indicating a possible re-auth such as error 403 or 401

One such example I ran into is when accessing cloud run MCP server and using OIDC id token to auth into the cloud run. The id token needs to be refreshed as it has a short TTL (as it should) but I found no solution in the adk framework so far to support that

[Jacksunwei]

For context: related discussion: #2113

[saibhupathi63]

This change introduces a flexible mechanism for providing access tokens to AuthCredential. It addresses the limitation where the access_token field could only hold a static token string, which is insufficient for scenarios where the token needs to be fetched dynamically at runtime.

This new mechanism allows access_token to be configured with a provider object that specifies how to retrieve the token. This decouples the credential configuration from the token retrieval logic, enabling support for tokens from various sources.

Key features:

[HttpBearerTokenProvider]: Extracts the token from the Authorization: Bearer header of an HTTP request.
[SessionStateTokenProvider]: Retrieves the token from a session object using a configurable key.
[TokenResolver]: A class that resolves the actual access token based on the provider configuration and the current context (e.g., an HTTP Request or session object).

How it will be used: Instead of providing a static token:
credential = AuthCredential(access_token="a_static_token_string")

A dynamic provider can be configured. For example, to get the token from an HTTP Bearer header, the configuration would be:
credential = AuthCredential(access_token={"source": "http_bearer"})

This allows components to resolve the token just-in-time when making authenticated requests, making the system more flexible and suitable for various authentication flows.