Complete Google Service Account Key Dynamic Validation

[jameswinkler]

The Google Service Account Key validator attempts to extract and validate application oauth credentials. This is tricky as it requires requesting an access token without knowing the scopes, and with many redirects involved in the flow. Some code is started in https://github.com/microsoft/sarif-pattern-matcher/tree/users/v-jwinkler/GoogleServiceAccountKeyValidator_DynamicValidationAndUnitTests. The code using GoogleWebAuthorizationBroker comes closest, producing output messages like "invalid client id" or "client id deleted", but unfortunately these messages are only visible in a browser that unit tests open. The unit tests themselves hang.

Determine if there's any way to programmatically read the results from the browser, simulate the flow, or find some other technology/library to verify the client id and secret.