Add authentication support

[merlimat]

Introduces a pluggable `Authentication` abstraction for attaching credentials to every outgoing RPC, matching the Java SDK.

API

```python
from oxia.auth import TokenAuthentication

client = oxia.Client(
'oxia.example.com:6648',
authentication=TokenAuthentication('my-secret-token'),
)

Dynamic token refresh:

def get_current_token():
return fetch_from_secrets_manager()

client = oxia.Client(
'oxia.example.com:6648',
authentication=TokenAuthentication(get_current_token),
)
```

Components

• `oxia.Authentication` ABC (in `oxia.defs`) — plugin point with a single `generate_credentials() -> dict[str, str]` method
• `oxia.auth.TokenAuthentication` — bearer-token implementation, supports static string or callable
• `authentication` parameter on `Client.init` — accepts any `Authentication` implementation
• `AuthenticationInterceptor` — gRPC client interceptor that injects credentials as metadata headers on every unary and server-streaming call. Keys are normalised to lowercase per gRPC convention.

Test plan

• Unit tests for TokenAuthentication (static token, dynamic supplier, ABC inheritance)
• Unit tests for AuthenticationInterceptor (metadata injection, existing-metadata preservation, lowercase normalisation, empty-creds short-circuit)
• Unit tests for ConnectionPool wiring
• Full test suite passes (51 unit + 23 integration)