tokenserver: Protos for service account rules.

tokenserver/api/oauth_token_grant.proto

Index: tokenserver/api/oauth_token_grant.proto
diff --git a/tokenserver/api/oauth_token_grant.proto b/tokenserver/api/oauth_token_grant.proto
index c98841f1c92fdb226135891e76ec1653ab057ff0..f98052fe209431ef10c72acd4d3a4932fea2a609 100644
--- a/tokenserver/api/oauth_token_grant.proto
+++ b/tokenserver/api/oauth_token_grant.proto
@@ -27,17 +27,19 @@ message OAuthTokenGrantBody {
   // A string of the form "user:<email>".
   string service_account = 2;
 
-  // Who requested this token and who can pass it to MintOAuthTokenViaGrant.
+  // Who can pass this token to MintOAuthTokenViaGrant to get an OAuth token.
   //
   // A string of the form "user:<email>". On Swarming, this is Swarming's own
   // service account name.
-  string wielder_identity = 3;
+  string proxy = 3;
 
   // An end user that wants to act as the service account (perhaps indirectly).
   //
   // A string of the form "user:<email>". On Swarming, this is an identity of
   // a user that posted the task.
-  string end_user_identity = 4;
+  //
+  // This is informational field currently (not used in authorization checks).
+  string end_user = 4;
 
   // When the token was generated (and when it becomes valid).
   google.protobuf.Timestamp issued_at = 5;