google impersonated service account: fail when scope not provided

The scope is a requirement of the [Service Account Credential generateAccessToken API](https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken)

WIth "impersonated_service_account" credential type, if the scope is not set, the token request fail.

The idea is to add a scope by default (i.e. the Cloud Platform scope) if no scope is provided.