[Event Hubs] Add live tests for SAS authentication and connection options

## Summary

The live tests authenticate with a token credential and with a connection string. They do not use a pre formed SAS token, although `src/common/sas_credential.rs` supports one. They do not use the `SendOnly` and `ListenOnly` authorization rules that `test-resources.bicep` already creates. The `with_custom_endpoint` builder option has no live coverage.

## Motivation

Each authentication mode takes a different code path to build the AMQP claim. A pre formed SAS token is the mode that a caller uses when a separate service mints the token. The scoped authorization rules prove that the SDK surfaces a clear error when a credential lacks a permission. The custom endpoint option matters for callers behind a gateway. Part of #4886.

## Proposal

- [ ] Open a producer and a consumer with a pre formed SAS token (.NET `ProducerCanSendAnEventBatchUsingTheSasCredential`, `ConsumerCanReadEventsUsingTheSasCredential`).
- [ ] Use the `SendOnly` and the `ListenOnly` authorization rules that `test-resources.bicep` already creates, and make sure that the disallowed direction fails.
- [ ] Open a client through `with_custom_endpoint` against a reachable endpoint (.NET `ConnectionTransportCanRetrieveMetadataWhenCustomValidationAcceptsTheCertificate` covers the adjacent path).

## Validation

Deploy the test resources with `eng/common/TestResources/New-TestResources.ps1 -ServiceDirectory eventhubs`. Set `EVENTHUBS_HOST` and `EVENTHUB_NAME`. Then run `AZURE_TEST_MODE=live cargo test --package azure_messaging_eventhubs --test '*'`. Each new test passes in live mode.