- In C++, we need a constant for the max lifetime.
- In C, make sure that we crop the lifetime in the credentials object
itself and not just later during the creation of the token. This will
allow the refresh to occur based on the actual token lifetime as opposed
to the one from the user (which may be cropped).

This reverts commit 5e01e2ac.

- make closures know where they should be executed (eg, on a workqueue,
  or a combiner, or on an exec_ctx)
- this allows removal of a large number of trampoline functions that
  were appearing whenever we used combiners, and should allow for a much
  easier interface to combiner locks

This will be useful when talking to non-trusted load balancer (balancers
which are not able to impersonate real backends) as these balancers
should not receive bearer tokens.

- We still need a way to bubble up this error.

As opposed to a flat directory, we now have the following structure:

- security
  -context
  - credentials
    - composite
    - fake
    - google_default
    - iam
    - jwt
    - oauth2
    - plugin
    - ssl
  - transport
  - util

We have not refactored the test code yet but this PR is already large
enough...

This extends the existing http parser to support requests as well as responses.

httpcli continues to exist and work as it has previously, though in the new
directory src/core/http (to reflect the fact the directory now contains code
relevant to parsing requests, which httpcli would not generally involve itself
in).

To do pollset work we need grpc to be initialized