/cc @frankyn. Follow-on from PR #7460; see also issue #922.

Currently, Blob.generate_signed_url can only be used where the blob's client has tokens which support signing (i.e., service accounts, GAE accounts). Although such credentials are widespread, they are not ubiquitous: in particular, the default credentials available on GCE do not support signing.

An alternate implementation is available using the IAM service and access tokens. For an outline, see the Ruby PoC for V4 signing.

For this issue, please adapt that implementation for both V2 and V4 signed URLs.