[PureGo] Add auth provider interfaces and per-table token cache

[zlata-stefanovic-db]

Summary

Second of a 3-PR stack. Stacked on #494 (base branch purego-transport-headers).

Introduces the auth package foundations:

• HeadersProvider interface — the single auth extension point, matching the Rust SDK (and duck-type compatible with the transport's local HeadersProvider from [PureGo] Add custom auth-header hook to transport #494).
• StaticHeadersProvider — returns a fixed headers map, for tests or externally managed credentials.
• A per-table token cache with proactive refresh and single-flight minting, which bounds a failing token endpoint to one mint per burst rather than N serial attempts.

OAuth-backed providers land in the follow-up PR.

Stack

1. [PureGo] Add custom auth-header hook to transport #494 — transport header hook
2. this PR — auth HeadersProvider + token cache
3. [PureGo] Add UC OAuth token provider with per-table caching #496 — UC OAuth provider

Test plan

• go build ./internal/auth/ and go test ./internal/auth/ pass.

Note

Rebased on the updated #494, which dropped StreamParams.Token in favor of the HeadersProvider hook. Auth is expressed solely through HeadersProvider; a speculative TokenProvider interface (and StaticTokenProvider) was dropped as unused, mirroring the Rust SDK where HeadersProvider is the only extension point. The header-provider types live in headers_provider.go.