refactor(cache): let remote cache requests carry auth headers

[wan9chi]

Motivation

The self-hosted remote cache server in #718, designed in #716, serves reads to anyone but accepts a store only with a GitHub Actions OIDC token. Other servers will need other credentials. For example, a private cache behind Cloudflare Access could need headers on every request. This adds one general hook so each kind of credentials is a separate implementation, and the client doesn't need to know about any of them.

Changes

• vt_remote_cache::auth::Auth supplies the headers for each request, given its operation: fetch, download, or store. It can use the client's HTTP client to get credentials, such as a token, and that client doesn't follow redirects. If it fails, the request isn't sent, and the operation fails with the new Error::Auth ("failed to authenticate").
• Client::new(endpoint, auth) takes the auth. Anonymous adds no headers.
• Planning resolves how requests authenticate into remote_cache.auth, next to the access mode and endpoint. The result holds everything needed to build the credentials, so nothing reads envs after planning. Choosing the auth from cache.remote config or envs later only changes this step. For now, the only kind is anonymous.
• vt turns the resolved auth into a vt_remote_cache auth with build_auth, a single match, and caches clients by endpoint and auth.

Requests don't change. Plan snapshots gain "auth": {"kind": "anonymous"}. The next PR in this stack adds GitHub Actions OIDC as the first auth with credentials.

🤖 Generated with Claude Code

[github-actions]

fspy benchmark

linux

dynamic/launch             change  -0.45%  [-13.18% .. +10.59%]  overhead  +311.61%
dynamic/access             change  +2.45%  [-11.74% .. +20.73%]  overhead   +18.24%
dynamic/access-relative    change  +1.87%  [ -5.10% .. +25.80%]  overhead   +66.86%
dynamic/access-contended   change  +2.43%  [-12.39% .. +12.47%]  overhead    -0.06%
static/launch              change  +1.67%  [ -9.20% .. +13.16%]  overhead  +645.35%
static/access              change  -0.06%  [ -2.45% ..  +1.42%]  overhead +1445.06%
static/access-relative     change  -0.45%  [ -2.16% ..  +0.91%]  overhead +1882.99%
static/access-contended    change  -0.91%  [ -3.36% ..  +0.91%]  overhead +1599.27%

macos

dynamic/launch             change  -0.10%  [ -6.36% ..  +5.38%]  overhead  +232.73%
dynamic/access             change  -1.08%  [ -5.65% ..  +4.13%]  overhead    +4.19%
dynamic/access-relative    change  +0.60%  [-18.71% .. +33.08%]  overhead  +248.55%
dynamic/access-contended   change  -0.26%  [-20.47% .. +26.83%]  overhead    +3.12%

windows

dynamic/launch             change  -2.98%  [ -9.74% ..  +5.65%]  overhead   +23.50%
dynamic/access             change  +1.11%  [ -5.47% .. +20.42%]  overhead    +2.59%
dynamic/access-relative    change  +0.35%  [ -1.41% ..  +1.84%]  overhead    +1.66%
dynamic/access-contended   change  +0.00%  [ -1.59% ..  +2.14%]  overhead    +0.90%