Per the GCS authentication doc:

Objects are anonymously accessible if the allUsers group has READ permission.

Add support for such access to the storage client. Two strategies seem possible:

• Add a classmethod factory to the Client class which bypasses inferring credentials from the user environment.
• Add a custom AnonymousCredentials singleton which can be passed to the Client constructor.

We don't need to enforce any limits on the access to buckets / objects retrieved from the "anonymous" client: the back-end will return UNAUTHORIZED.

System tests can use the gcp-public-data-landsat bucket, if desired (hopefully CI throttling won't be an issue).