feat: add HTTP message signature signal to network-acl rules (EA only)

[bkiran6398]

🔧 Changes

Adds support for the http_message_signature signal on network ACL rules, letting a rule match (or not match) traffic by the HMAC signing key that signed the request. This is Early Access, gated behind the tenant_acl_hmac_signature feature flag.

• Adds a --signature-key-ids flag to network-acl create and network-acl update.
• Adds an interactive key picker that lists the tenant's existing Network ACL keys by name and pre-selects the keys already on the rule.
  Usage:

auth0 network-acl create
auth0 network-acl create -d "Require signed traffic" -p 1 --active true --signature-key-ids "key_abc,key_def"
auth0 network-acl create -d "Require signed traffic" -p 1 --active true \
  --rule '{"action":{"block":true},"scope":"tenant","not_match":{"http_message_signature":{"keys":[{"id":"key_abc"}]}}}'

📚 References

• Depends on SDK v1 PR: feat: add HTTP message signature signal to Network ACL rule match (EA only) go-auth0#857

🔬 Testing

• Unit tests cover rule building for match/not_match, extraction of current key ids into update defaults, and the display rows for both cases.
• make test-unit, make lint, and make check-docs pass.
• Manual: against an EA-enabled tenant with the flag on, verified the interactive picker lists keys and pre-selects current ids on update, that a tenant with no keys errors and a rule set via --rule round-trips through show.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)