[FIP-49][gateway] Add HTTP-layer REST authentication and protocol-neutral principals

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

[FIP-49](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/444334561/FIP-49%2BFluss%2BGateway%2BREST%2BAPI) requires the Gateway to authenticate clients before they access protected REST APIs. This task adds the configured HTTP authentication mechanisms and represents a successful authentication as a protocol-neutral `Principal` in the request context.

It also defines consistent authentication failures and challenges, OpenAPI security declarations, credential protection, and the corresponding tests. All Fluss access continues to use the configured service identity; propagating HTTP principals to Fluss is future work.

Part of FIP-49 and tracked by #3957.

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start by reading FIP-49 and inspecting the Gateway REST authentication entry points and request context. Trace the existing protected REST API and test structure, then verify that configured HTTP authentication produces protocol-neutral principals, consistent failures and challenges, OpenAPI security declarations, protected credentials, and corresponding tests.

Written by the indexing model from the issue text.