[git_cl] Let creds-check revert new auth config changes

Gated this behind new auth flag explicitly being set (so people who
haven't set anything = default off don't run this, just in case)

Bug: b/351024645
Change-Id: I8498b98404ad89d3ca390d3baa798daee0b4b53b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5698379
Reviewed-by: Yiwei Zhang <yiwzhang@google.com>
Commit-Queue: Allen Li <ayatane@chromium.org>

git_cl.py

@@ -3674,6 +3674,14 @@ def ConfigureGitRepoAuth() -> None:
     GitAuthConfigChanger.new_from_env().apply(os.getcwd())
 
 
+def ClearGitRepoAuth() -> None:
+    """Clear the current Git repo authentication."""
+    logging.debug('Clearing current Git repo authentication...')
+    c = GitAuthConfigChanger.new_from_env()
+    c.mode = GitConfigMode.OLD_AUTH
+    c.apply(os.getcwd())
+
+
 class GitConfigMode(enum.Enum):
     """Modes to pass to GitAuthConfigChanger"""
     NEW_AUTH = 1
@@ -4019,6 +4027,8 @@ def CMDcreds_check(parser, args):
     if newauth.Enabled():
         ConfigureGitRepoAuth()
         return 0
+    if newauth.ExplicitlyDisabled():
+        ClearGitRepoAuth()
 
     # Code below checks .gitcookies. Abort if using something else.
     auth_name, _ = gerrit_util.debug_auth()

newauth.py

@@ -17,6 +17,13 @@ def Enabled() -> bool:
                                                                 'true', '1')
 
 
+def ExplicitlyDisabled() -> bool:
+    """Returns True if new auth stack is explicitly disabled."""
+    return scm.GIT.GetConfig(os.getcwd(),
+                             'depot-tools.usenewauthstack') in ('no', 'off',
+                                                                'false', '0')
+
+
 def SkipSSO() -> bool:
     """Returns True if skip SSO is set."""
     return scm.GIT.GetConfig(os.getcwd(),