Make the ring dependency optional

[a-kenji]

Make the dependency on ring truly optional.
It is still used by default through the ring feature, but when disabling we don't depend on the ring dependency anymore.

This also means that the signature is now created by the configured crypto provider as opposed to unconditionally by ring, which was the case before. E.g.: Before, even without the ring dependency and with the aws-lc-rs feature enabled signing of the JWT token was done through the ring signatures.

When adding gcp_auth without any features enabled and without default features, it will not compile anymore and instead throw a compile_error!, which explains that we need at least one provider and how to enable it.

Which was in essence already the case, look at, when compiling with --no-default-features:

error[E0599]: no method named `with_native_roots` found for struct `HttpsConnectorBuilder<State>` in the current scope
  --> src/types.rs:40:14
   |
39 |           let https = HttpsConnectorBuilder::new()
   |  _____________________-
40 | |             .with_native_roots()
   | |             -^^^^^^^^^^^^^^^^^ method not found in `HttpsConnectorBuilder<WantsTlsConfig>`
   | |_____________|
   |

For more information about this error, try `rustc --explain E0599`.
error: could not compile `gcp_auth` (lib) due to 1 previous error

Closes: #153

[a-kenji]

Thank you for the review so far!

I now split it up into two commits:

• 7998f4b: This allows us to compile without any default crypto features and then rely on the application to provide the correct environment. This supercedes the compile error we would have thrown, instead we throw an error when the default provider can't be initialized. This also pulls rustls as a direct dependency, but that was in the dependency tree anyways.
• f0d0766: The actual commit making ring optional, now gating all the actual signing logic behind either the ring, or aws-lc-rs feature.

[djc]

LGTM, thanks!

[a-kenji]

Thank you for the reviews!

[flokli]

Thanks! Is it possible to tag a release with this, so downstream consumers can use it?

[djc]

Yup: 0.12.7.