Add with_scopes_if_required helper (#65)

diff --git a/google/auth/credentials.py b/google/auth/credentials.py
index ef28bd7..59d4ffe 100644
--- a/google/auth/credentials.py
+++ b/google/auth/credentials.py
@@ -186,6 +186,30 @@
         return set(scopes).issubset(set(self._scopes or []))
 
 
+def with_scopes_if_required(credentials, scopes):
+    """Creates a copy of the credentials with scopes if scoping is required.
+
+    This helper function is useful when you do not know (or care to know) the
+    specific type of credentials you are using (such as when you use
+    :func:`google.auth.default`). This function will call
+    :meth:`Scoped.with_scopes` if the credentials are scoped credentials and if
+    the credentials require scoping. Otherwise, it will return the credentials
+    as-is.
+
+    Args:
+        credentials (Credentials): The credentials to scope if necessary.
+        scopes (Sequence[str]): The list of scopes to use.
+
+    Returns:
+        Credentials: Either a new set of scoped credentials, or the passed in
+            credentials instance if no scoping was required.
+    """
+    if isinstance(credentials, Scoped) and credentials.requires_scopes:
+        return credentials.with_scopes(scopes)
+    else:
+        return credentials
+
+
 @six.add_metaclass(abc.ABCMeta)
 class Signing(object):
     """Interface for credentials that can cryptographically sign messages."""