feat(agent): wire Conjur JWT config into the top-level CyberArk client - #823

Introduces a small, isolated interface for reading a JWT from a file
path — the first piece of the upcoming Conjur JWT authentication path,
split out on its own since nothing else in this PR depends on it yet.

Adds NewRequestAuthenticator, choosing between the new Conjur JWT
exchange and the legacy CyberArk Identity username/password login based
on which config is present — Conjur JWT takes priority when both are
set. Conjur JWT requires service_id and resolves its base URL from the
secrets_manager service discovered in the prior PR, not
identity_administration; the two are different hosts. The identity API
is only required on the username/password path now; Conjur JWT never
uses it.

Switches keyfetch's client over to the new authenticator selection
instead of constructing a username/password identity client directly.
Doing so dropped keyfetch's own per-fetch LoginUsernamePassword call, which
was the only thing keeping the cached identity token from aging out —
identity.Client.AuthenticateRequest never refreshed on its own. Give it
the same self-refreshing behavior conjur.Client already has: it now
re-logs-in internally once its cached token passes tokenTTL (a field,
not a const, so tests can shrink it), using a durable copy of the
credentials it captured at the last LoginUsernamePassword call — the
caller's own password slice is still zeroed as before. A refresh that
fails falls back to whatever's cached rather than failing the request
outright, since the next call will retry.

Hoists the jwt_source validation and the "file"/"conjur" literals this
and the agent config layer both encode separately into shared
JWTSourceFile/DefaultAccount consts and a ValidateJWTSource helper, and
drops the "POC" wording from the operator-facing error.

NewCyberArk and the agent config schema were still legacy-username/password-only
at the top level, even though the underlying authenticator selection (previous
PR) already supports Conjur JWT. Threads service_id/account/jwt_source/jwt_file_path
through cyberark.service_id in the agent config down to NewCyberArk, so the
config file is the single place an operator chooses which authentication method
to use.

config.go's call site and client_cyberark.go's signature change together —
splitting them across two PRs would leave one non-building at every commit
in between.

jwt_source validation now delegates to the shared cyberark.ValidateJWTSource
(previous PR) instead of re-implementing the same rule with different wording.

Requiring an auth method (service_id or ARK_USERNAME) is now checked at
config-validation time rather than left to cyberark.selectAuthenticator alone
— that only runs at first upload, so a misconfigured agent could otherwise
report healthy for up to a full config.period before failing.

Adds FakeCyberArkUsernamePassword and a matching integration test: the only
existing test exercising NewCyberArk's username/password path set
ARK_USERNAME/ARK_SECRET but also passed a non-empty serviceID, which
selectAuthenticator prioritises — so it silently tested Conjur regardless of
those env vars, leaving the legacy path with no coverage through this seam.