Epic: BYOIDC bearer-token authentication for confluent_sql #148

Confluent Cloud customers who run their own OAuth/OIDC identity provider need to authenticate this driver with a bearer token they mint themselves — an external token, in Confluent's authorization vocabulary — rather than a Confluent API key + secret. This epic covers that BYOIDC (bring-your-own-IdP) surface end to end, as small independently-shippable children.

Scope boundary: Flink data plane only

By Confluent's authorization model (verified against the Cloud OpenAPI spec's per-operation AUTHORIZATIONS blocks), a raw external token authenticates the Flink data plane and nothing on api.confluent.cloud. None of /tableflow/v1, /connect/v1, /cmk/v2/clusters, or /org/v2/organizations accept external-access-token. So every child here is Flink-only, and the control plane fails closed with an error. Reaching the control plane with a caller identity is a different problem, covered in a separate epic, which mints Confluent's own tokens.

The bar: cover plugin #399's BYOIDC half

The neighboring Java Table API client shipped two BYOIDC-flavoured modes in one large PR: a static external-access-token and a refreshing client-credentials provider. This epic covers the same ground as a sequence of bounded children rather than one mega-PR