[rust] Support SASL/PLAIN authorization identity(act as)

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

FIP-49 user/act-as mode requires the Rust client to authenticate with the Gateway service credential while sending the authenticated HTTP principal as a separate SASL/PLAIN authorization identity. This task:

- adds an optional SASL/PLAIN authorization identity to the Rust client without changing the existing authentication identity;
- preserves the current wire behavior when the authorization identity is not configured;
- covers omitted, empty, and non-empty authorization identities in SASL/PLAIN encoding tests;
- redacts the authentication identity, authorization identity, and password from errors and logs; and
- adds a fixed-version real-cluster test for allowed and denied impersonation against the server implementation from #3837/#3857.

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start by locating the Rust client's SASL/PLAIN encoder, authentication and error/logging paths, then read the existing encoding tests. Cover omitted, empty, and non-empty authorization identities while preserving current behavior without one, and run the fixed-version real-cluster test against the server implementation from #3837/#3857 for allowed and denied impersonation.

Written by the indexing model from the issue text.