xDS gRPC CallCredentials: support loading service account key from file system

Today when using a service account key as xDS gRPC call credentials, the content of the service account key needs to be included in Envoy bootstrap config. E.g.

grpc_services:
    - google_grpc:
        ...
        call_credentials:
          service_account_jwt_access:
            json_key: <content of service account key>
            token_lifetime_seconds: xxx

It would be better, if there is an option to keep service account key outside of bootstrap config in a file and reference the file path in bootstrap config.