Iceberg REST catalog: support a bearer token file that is re-read per request

[Robin-Everaars]

Problem

The Iceberg REST catalog takes a bearer token from config
(catalog.list[].bearer_access_token, env SAIL_CATALOG__LIST). The value is
read once at startup and held for the process lifetime. In Kubernetes the common
way to authenticate to a REST catalog is a projected ServiceAccount token, which
kubelet rotates on a schedule (by default once 80% of the token lifetime has
elapsed). Because Sail never re-reads the token, the rotated token is ignored and
requests start failing with 401 once the original token expires, until the server
is restarted.

Proposal

Add an optional bearer_access_token_file to the Iceberg REST catalog config: a
path to a file holding the bearer token. When set, the token is read from that
file and refreshed when the file changes, so a rotated projected token is picked
up without a restart. It takes precedence over bearer_access_token.

main already resolves credentials per request through
CatalogCredentials::retrieve(), so this is a small addition: a new
FileCatalogCredentials implementation plus the config field and wiring.

Alternatives considered

• Static bearer_access_token: cannot rotate, the problem above.
• OAuth token exchange: heavier, needs an auth server and does not match the
  projected-token pattern where kubelet already handles rotation on disk.