changefeedccl: add file-based OAuth client assertion support

[KeithCh]

security/secretdir: add jailed credential reader and --secret-directory flag
Add infrastructure for node-local subsystems to read credential
files from a single operator-bounded directory.

Example:
cockroach start --secret-directory=/etc/cockroach/secrets ...

---

changefeedccl: thread BuildContext through saslMechanismBuilder
BuildContext is an extension point on saslMechanismBuilder for
passing resources beyond URI params, letting individual mechanisms
pull their own dependencies without dispatcher-level special-casing.
Today it carries a *secretdir.Reader, which exposes credential
files from the directory configured by the --secret-directory node
flag.

---

changefeedccl: add file-based OAuth client assertion support

Add sasl_proprietary_client_assertion_location URI parameter for Kafka changefeeds to reference a file-based OAuth client assertion.

e.g.

CREATE CHANGEFEED FOR t INTO 'kafka://.../?sasl_proprietary_client_assertion_location=/path/to/jwt'

The path needs to be an absolute path.

All nodes should have the --secret-directory flag set to the same directory. Users need the EXTERNALIOIMPLICITACCESS privilege to use create changefeeds that use file-based OAuth client assertions. Exactly one of sasl_proprietary_client_assertion_location or sasl_proprietary_client_assertion should be set when using PROPRIETARY_OAUTH.

Release note: None
Epic: CRDB-62004

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[cockroach-teamcity]

This change is 

[blathers-crl]

Detected infrastructure failure (matched: self-hosted runner lost communication with the server). Automatically rerunning failed jobs. (run link)

[blathers-crl]

Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[github-actions]

AI Review: Potential Issue(s) Detected

Inline comments have been added to the relevant lines in pkg/server/server_sql.go.

Summary: The PR accidentally deletes the ResourceGroupCache initialization (resourcegroupcache.New()) and its import in pkg/server/server_sql.go. These two lines are unrelated to the PR's purpose (file-based OAuth client assertion support for changefeeds) and appear to have been lost during rebase or merge conflict resolution. The field declaration (exec_util.go:1993) and usage (vars.go:1466) remain intact, but without initialization SET resource_group is silently broken for all users — it always returns "unknown resource group".

View full analysis

---

If helpful: add O-AI-Review-Real-Issue-Found label.
If not helpful: add O-AI-Review-Not-Helpful label.