chore(flags): Phase 2 — accept PSAK on the Django flag surfaces

Phase 2 of #63111.

Accept PSAK on the Django surfaces that authenticate with the legacy team secret token today. Keep TeamSecretTokenAuthentication in place for back-compat throughout.

Tasks

• remote_config: add ProjectSecretAPIKeyAuthentication and psak_allowed_actions = ["remote_config"], keep TeamSecretTokenAuthentication, and confirm scope enforcement and team binding.
• Conversations external API: add PSAK support alongside (or replacing) the direct Q(secret_api_token=…) lookup. This product chose the team secret token deliberately because api_token is public, so loop in its owners and confirm PSAK semantics fit.
• Resolve the header-only vs body-token difference. Legacy auth accepts the token in the request body; PSAK is header-only. Audit whether anything sends the secret token in the body for these endpoints; if so it stays on the legacy path until it moves to the header.

Acceptance

• A feature_flag:read PSAK authenticates remote_config (and any other migrated surface) with correct scope and team enforcement.
• Existing team secret tokens keep working unchanged.