[git_cl] Fix creds_check new auth switch logic pt 3

Third time's the charm.  The issue is still the "multi-valued boolean"
logic.  I introduce a new "switched on" concept to clarify things.

If new auth is "switched off", then all new auth related things are
off.  Simple enough.

There are two ways for new auth to be "switched on".  Either it is
explicitly enabled in the user's config, or we rolled out the default
to on.

When it is "switched on", we still rely on the presence of .gitcookies
to determine whether we enable new auth for depot_tools.  HOWEVER, we
must use the new git cl creds-check, because that is the intended way
for users to remove their .gitcookies file.

                     | auth logic | creds-check |
switched off         | old        | old         |
switched on +cookies | old        | new         |
switched on -cookies | new        | new         |

Change-Id: I311089960d78d8be2cdffd00e4515bfebf0f8f58
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6439385
Commit-Queue: Allen Li <ayatane@chromium.org>
Reviewed-by: Gavin Mak <gavinmak@google.com>

git_cl.py

@@ -3902,7 +3902,7 @@ def CMDcreds_check(parser, args):
     """Checks credentials and suggests changes."""
     _, _ = parser.parse_args(args)
 
-    if newauth.Enabled():
+    if newauth.SwitchedOn():
         cl = Changelist()
         try:
             remote_url = cl.GetRemoteUrl()

newauth.py

@@ -13,7 +13,7 @@ import scm
 
 def Enabled() -> bool:
     """Returns True if new auth stack is enabled."""
-    if not EnabledInConfig():
+    if not SwitchedOn():
         return False
     if _HasGitcookies():
         _PrintGitcookiesWarning()
@@ -21,6 +21,23 @@ def Enabled() -> bool:
     return True
 
 
+def SwitchedOn() -> bool:
+    """Returns True if new auth stack is "switched on".
+
+    Note that this does not necessarily mean that new auth is enabled.
+    In particular, we still disable new auth if a .gitcookies file is
+    present, to protect bots that haven't been migrated yet.
+    """
+    if Default():
+        return not ExplicitlyDisabled()
+    return ExplicitlyEnabled()
+
+
+def Default() -> bool:
+    "Returns default enablement status for new auth stack."
+    return False
+
+
 def _HasGitcookies() -> bool:
     """Returns True if user has gitcookies file."""
     return os.path.exists(os.path.expanduser('~/.gitcookies'))
@@ -48,8 +65,8 @@ https://issues.chromium.org/issues/new?component=1456702&template=2076315
 ''')
 
 
-def EnabledInConfig() -> bool:
-    """Returns True if new auth stack is enabled.
+def ExplicitlyEnabled() -> bool:
+    """Returns True if new auth stack is explicitly enabled.
 
     Directly checks config and doesn't do gitcookie check.
     """