credentials/alts: preserve boundAccessToken in altsTC.Clone (#9345)

`altsTC.Clone` does not copy `boundAccessToken`, so a cloned ALTS
credential silently loses the token and performs its handshake without
it.

RELEASE NOTES: none

credentials/alts/alts.go

diff --git a/credentials/alts/alts.go b/credentials/alts/alts.go
index b8afa91..9fb7170 100644
--- a/credentials/alts/alts.go
+++ b/credentials/alts/alts.go
@@ -266,10 +266,11 @@
 		copy(accounts, g.accounts)
 	}
 	return &altsTC{
-		info:      &info,
-		side:      g.side,
-		hsAddress: g.hsAddress,
-		accounts:  accounts,
+		info:             &info,
+		side:             g.side,
+		hsAddress:        g.hsAddress,
+		accounts:         accounts,
+		boundAccessToken: g.boundAccessToken,
 	}
 }
 

credentials/alts/alts_test.go

diff --git a/credentials/alts/alts_test.go b/credentials/alts/alts_test.go
index dba11df..cb751ce 100644
--- a/credentials/alts/alts_test.go
+++ b/credentials/alts/alts_test.go
@@ -91,6 +91,7 @@
 	opt := DefaultClientOptions()
 	opt.TargetServiceAccounts = []string{"not", "empty"}
 	c := NewClientCreds(opt)
+	c.(*altsTC).boundAccessToken = "bound-access-token"
 	c.OverrideServerName(wantServerName)
 	cc := c.Clone()
 	if got, want := cc.Info().ServerName, wantServerName; got != want {
@@ -116,6 +117,9 @@
 	if !reflect.DeepEqual(ct.accounts, cct.accounts) {
 		t.Errorf("cc.accounts = %q, want %q", cct.accounts, ct.accounts)
 	}
+	if ct.boundAccessToken != cct.boundAccessToken {
+		t.Errorf("cc.boundAccessToken = %q, want %q", cct.boundAccessToken, ct.boundAccessToken)
+	}
 }
 
 func (s) TestCloneServer(t *testing.T) {