feat(vector): add token authentication to the gRPC source and sink

[stigglor]

Summary

Adds an optional auth setting on both components, supporting the bearer, basic, and custom strategies via a new VectorAuthConfig type that reuses the existing HTTP auth header logic.

The sink sends the credentials on every request, including the health check. The source validates incoming requests with a tonic interceptor using a constant time comparison, and rejects mismatches with an Unauthenticated status. The standard gRPC health service stays open so liveness probes do not need credentials. The token is a normal config value, so it can come from a secrets backend with SECRET[...].

Vector configuration

How did you test this PR?

The bearer-token auth was verified at two levels. Automated: unit tests for the source covering a matching token auth_roundtrip, a missing token, and a wrong token, both rejected with Unauthenticated, plus a constant-time-compare test and an http test confirming VectorAuthConfig produces the right Authorization header for bearer/basic/custom.
End-to-end: a single live vector process wired as demo_logs → vector sink → vector source → console, where matching tokens delivered all 5 events to the console, and a mismatched token produced zero delivered events with the source returning Unauthenticated: "Valid authorization token required.", a failed healthcheck, and the request correctly dropped as non-retriable.

Change Type

• Bug fix
• New feature
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

References

Closes #2017