add validation to ensure ImpersonatedCredential can only be SA or User Credentials

[zhumin8]

This line in javadoc specifies ImpersonatedCredential can only be SA or User Credentials in this create() method, but it is not enforced.

https://github.com/googleapis/google-auth-library-java/blob/a8d466f3951686ddf0f6a7ae429cab505b337c54/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java#L120

For context: https://github.com/googleapis/google-auth-library-java/pull/1566#discussion_r1882521720