ci(spanner): use airlock for presubmit jobs

.kokoro/build.sh

@@ -28,7 +28,7 @@ export PYTHONUNBUFFERED=1
 env | grep KOKORO
 
 # Setup service account credentials.
-export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/service-account.json
+# export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/service-account.json
 
 # Set up creating a new instance for each system test run
 export GOOGLE_CLOUD_TESTS_CREATE_SPANNER_INSTANCE=true
@@ -48,6 +48,8 @@ fi
 
 set -x
 if [[ $USE_AIRLOCK = 'true' ]]; then
+python3 -m pip install --upgrade pip
+python3 -m pip install -r .kokoro/requirements-auth.txt -i https://pypi.org/simple/ --require-hashes --only-binary :all:
 cat > $HOME/.pypirc <<EOL
 [distutils]
 index-servers =
@@ -61,6 +63,7 @@ EOL
 [global]
 index-url = https://us-python.pkg.dev/artifact-foundry-prod/python-3p-trusted/simple/
 EOL
+python3 -m pip install 'grpcio' --verbose
 fi
 
 # If NOX_SESSION is set, it only runs the specified session,