gerrit_util: add ensure_authenticated to ChainedAuthenticator

Implements ensure_authenticated in ChainedAuthenticator to call the
first applicable authenticator.

In addition, makes `GitCredsAuthenticator.is_applicable` work when `gerrit_host` isn't provided, and caches the result to avoid sending
redundant RPCs for the same host.

This change is slightly risky because we'll start exercising
ensure_authenticated code path on different Authenticators. Though
currently, only .gitcookies (CookiesAuthenticator) implements this
check.  With newauthstack shipped, CookiesAuthenticator shouldn't be used for normal workflows.

If you suspect this change has caused a breakage, please file a bug and
revert this CL.

Bug: 348024314
Change-Id: I420929bd552d7804d53a5f118f8d8c2d10940480
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/7065052
Reviewed-by: Scott Lee <ddoman@chromium.org>
Commit-Queue: Jiewei Qian <qjw@chromium.org>
Reviewed-by: Allen Li <ayatane@chromium.org>

gerrit_util.py

@@ -966,8 +966,11 @@ class GitCredsAuthenticator(_Authenticator):
                 "Got error trying to cache 'depot-tools.hostHasAccount': %s", e)
         return True
 
+    @functools.cache
     def is_applicable(self, *, gerrit_host: Optional[str] = None):
-        return self.gerrit_account_exists(gerrit_host)
+        if gerrit_host:
+            return self.gerrit_account_exists(gerrit_host)
+        return False
 
 
 class NoAuthenticator(_Authenticator):
@@ -1020,6 +1023,15 @@ class ChainedAuthenticator(_Authenticator):
     def debug_summary_state(self) -> str:
         return ''
 
+    def ensure_authenticated(self, *, gerrit_host: str,
+                             git_host: str) -> Tuple[bool, str]:
+        for a in self.authenticators:
+            if a.is_applicable(gerrit_host=gerrit_host):
+                return a.ensure_authenticated(gerrit_host=gerrit_host,
+                                              git_host=git_host)
+        return (False,
+                f'{self!r} has no applicable authenticator for {gerrit_host}')
+
 
 class ReqParams(TypedDict):
     uri: str