feat(agent): select Conjur JWT or legacy username/password authenticator - #822

identity.go mixed the shared client/token-cache plumbing with the
CyberArk Identity username/password (UP) login flow. Move the UP-specific
code into username_password.go so the shared plumbing stays easy to find
once a second login mechanism (Conjur JWT) is added alongside it.

No behavior change — pure extraction, plus exporting the mock's success
credentials for other packages' tests.

Exchanges a projected ServiceAccount JWT (via jwtsource) for a Conjur
access token through the authn-jwt endpoint, and authenticates requests
with it as identity.RequestAuthenticator. Nothing wires this in yet —
that's the next PR, once both this and the legacy identity client exist
side by side.

The identity returned for audit tagging is the token's own sub claim
when it can be extracted, falling back to the configured service ID
otherwise. The cache expiry is driven by the token's own exp claim when
present, falling back to a guessed TTL only when it isn't — a fixed TTL
stamped after the exchange returns would otherwise serve a token past
its real expiry under latency or clock skew. Exposes Invalidate() so a
caller that gets a 401 from the resource server can force a fresh
exchange instead of waiting out the cache.

Adds NewRequestAuthenticator, choosing between the new Conjur JWT
exchange and the legacy CyberArk Identity username/password login based
on which config is present — Conjur JWT takes priority when both are
set. Conjur JWT requires service_id and resolves its base URL from the
secrets_manager service discovered in the prior PR, not
identity_administration; the two are different hosts. The identity API
is only required on the username/password path now; Conjur JWT never
uses it. Since service discovery already errors on a missing
identity_administration API before selectAuthenticator ever runs, the
username/password branch no longer re-checks it — that check could
never actually fire.

Switches keyfetch's client over to the new authenticator selection
instead of constructing a username/password identity client directly.
Doing so dropped keyfetch's own per-fetch LoginUsernamePassword call, which
was the only thing keeping the cached identity token from aging out —
identity.Client.AuthenticateRequest never refreshed on its own. Give it
the same self-refreshing behavior conjur.Client already has: it now
re-logs-in internally once its cached token passes tokenTTL (a field,
not a const, so tests can shrink it), using a durable copy of the
credentials it captured at the last LoginUsernamePassword call. A
refresh that fails falls back to whatever's cached rather than failing
the request outright, since the next call will retry.

LoginUsernamePassword no longer zeroes the caller's password slice: it
already keeps its own durable copy (needed for the self-refresh above),
so wiping the caller's copy bought nothing and actively broke callers
that reuse one ClientConfig across multiple logins — cfg.Secret is a
[]byte shared across every upload cycle via NewCyberArk's configLoader
closure, so the second call received an already-zeroed password and
failed to authenticate. Reproduced live before fixing: a second
PostDataReadingsWithOptions call on the username/password path failed
with "Authentication ... has failed" every time.

Hoists the jwt_source validation and the "file"/"conjur" literals this
and the agent config layer both encode separately into shared
JWTSourceFile/DefaultAccount consts and a ValidateJWTSource helper, and
drops the "POC" wording from the operator-facing error.