[Bug report] Built-in Iceberg jobs fail when server authenticators are enabled

### Version

main branch

### Describe what's wrong

Built-in Iceberg maintenance jobs cannot authenticate when the Gravitino server enables authenticators (for example `gravitino.authenticators = oauth,basic`).

1. `builtin-iceberg-update-stats` builds a `GravitinoClient` from URI + metalake only (`GravitinoClientUtils`), with no `withSimpleAuth` / `withOAuth` / basic auth. Callbacks to the Gravitino API fail with `UnauthorizedException`.
2. `builtin-iceberg-rewrite-data-files` (and other Spark Iceberg jobs) configure the Spark Iceberg REST catalog with only `type` / `uri` / `warehouse`, so Iceberg REST requests fail with `NotAuthorizedException` when IRC requires auth.

Credentials should be passed through job template `environments`, and the client / Spark catalog must match the server authenticator.

### Error message and/or stacktrace

```
org.apache.gravitino.exceptions.UnauthorizedException: The provided credentials did not support
```

```
org.apache.iceberg.exceptions.NotAuthorizedException: Not authorized: The provided credentials did not support
```

### How to reproduce

1. Enable server auth, e.g. `gravitino.authenticators = oauth,basic`.
2. Run `builtin-iceberg-update-stats` with `update_mode: all` against an Iceberg REST catalog, or run `builtin-iceberg-rewrite-data-files`.
3. Observe unauthorized failures on the Gravitino API callback and/or Iceberg REST catalog calls.

### Additional context

Related enterprise report: datastrato/gravitino-enterprise#1956.