feat: sidecar-local secret store and http_secret_providers config

[nappa85]

Why

PR05 added the rewrite codec and gateway client as standalone pieces. This
PR adds the last two prerequisites before they can be wired into the
request pipeline (PR07): an in-memory placeholder↔secret dictionary scoped
to a single request/response cycle, and the SidecarConfig field that
lets an operator declare which HTTP vaults to intercept.

What Changed

• crates/firma-sidecar/src/secret_store.rs (new): SidecarSecretStore,
  an in-memory dictionary built per-request from the
  (placeholder, secret_bytes) pairs returned by
  secret_gateway_client::resolve_batch (PR05), discarded after
  forwarding — firma-run remains the sole persistent store. Uses
  Aho-Corasick for scanning, mirroring firma_run::secret::SecretStore's
  design but living in the Sidecar crate to avoid a circular dependency.
  SecretValue wraps its bytes in Zeroizing so they're wiped on drop.
• crates/firma-sidecar/src/config.rs: adds http_secret_providers to
  SidecarConfig — the HTTP-vault counterpart to firma-run's
  secret_providers, declaring which hosts/response shapes to intercept
  and how to extract secrets from them (IntegrationSpec::Http from
  firma-secret-provider).
• crates/firma-sidecar/src/lib.rs: module wiring for secret_store.

Risks / Notes

• Still not wired into RequestHandler — SidecarSecretStore and the new
  config field are inert until PR07.
• SecretValue's zeroize-on-drop matches the existing pattern in
  firma-run::secret::SecretValue; no new zeroization approach
  introduced.

AI Assistance

Generated with AI (Claude Code); human-reviewed for correctness and scope.