Feat/oauth2 interactive auth

[maltesander]

Description

Adds Trino's interactive (browser-based) OAuth2 authentication alongside the
existing Basic and JWT support.

Trino's OAuth2 makes the coordinator the OAuth client — the client never talks
to the IdP directly (no client_id/PKCE/code exchange, so no oauth2/openidconnect
crate needed). The client reacts to a 401 carrying
WWW-Authenticate: Bearer x_redirect_server=..., x_token_server=... by presenting the
login URL to the user, polling the token server until it gets a bearer token, then
retrying the request. From there it's identical to the existing JWT bearer path.

Usage

let client = ClientBuilder::new("user", "coordinator.example.com")
    .secure(true)
    .auth(Auth::new_oauth2())        // browser + stderr fallback by default
    .build()?;

Bring your own presentation strategy with Auth::new_oauth2_with_handler(...) (a
RedirectHandler trait — headless, custom callback, etc.), and tune the token poll
loop with .with_poll(max_attempts, timeout).

How it fits

• Auth is applied per-request via Client::auth_req, and the 401 is intercepted at
  the single Client::send choke point — below the backon retry layer, so the
  retry predicates are untouched.
• New Auth::OAuth2(Arc) variant carries the in-memory token cache +
  redirect handler; concurrent 401s are de-duplicated by a single-flight lock so the
  browser opens once.
• Token expiry is reactive (a fresh 401 re-enters the flow); token cached in-memory
  for the life of the Client (no persistence, no machine-to-machine flow in this PR).

Breaking change

Auth is now #[non_exhaustive] and has a new OAuth2 variant — exhaustive match
on Auth must add a wildcard arm. See MIGRATION.md.

Tests

• Unit: WWW-Authenticate parser (incl. the bearer x_redirect_server quirk,
  non-ASCII safety), token poll loop (nextUri follow, error, timeout bound).
• Integration (tests/oauth2.rs, wiremock, no browser): full 401 → poll → bearer
  round-trip, token caching, single-flight (browser once under concurrency), 401
  without a challenge stays HttpNotOk, and re-auth sends exactly one
  Authorization header.
• Manual e2e: #[ignore]d oauth2_real_login + a committed local Trino + Keycloak
  stack under integration_tests/test_setup/oauth/. Verified end-to-end against a real
  browser login. Not wired into CI (the interactive flow needs a human).

Both default and spooling feature sets build/test green; clippy -D warnings clean.