The creation of the job proxy should be pluggable.  If nothing else this will
allow independent selection of the setuid callout for this operation.  On a
grander scale, this would allow for the usage of a credential repository that
would enable a job process on a compute node without a shared file system with
the GRAM node to retrieve the credential.