Add cluster-level automatic failover support (AutoClusterFailover)

**Summary**

The C++ client does not support cluster-level failover — the ability for a Pulsar client to automatically switch from a primary cluster to a secondary cluster when the primary becomes unavailable.

**Context**

The Java client has supported this since Pulsar 2.10 (May 2022) via `AutoClusterFailover` and `ControlledClusterFailover`, both built on the `ServiceUrlProvider` abstraction. The .NET client (Pulsar.Client) has also independently implemented equivalent functionality via `IServiceInfoProvider`. The C++ client still lacks this capability. Since the C++ client is the foundation for several language bindings (Node.js, Python), this gap propagates across multiple client ecosystems. Adding cluster-level failover here would bring the C++ client to parity with Java and unblock the same capability in downstream clients.

**Proposed Behavior**

1. A `ServiceUrlProvider` (or equivalent) abstraction that allows pluggable URL resolution.
2. An `AutoClusterFailover` implementation that:
- Accepts a primary service URL and one or more secondary service URLs.
- Runs a background probe task at a configurable `checkInterval` (default: 30s).
- Switches to the first healthy secondary if the primary is unreachable for longer than `failoverDelay` (default: 30s).
- Switches back to the primary once it recovers and stays healthy for `switchBackDelay` (default: 60s).
- Supports per-cluster authentication and TLS configuration.

**Use Case**

Pulsar deployments with geo-replication across multiple regions need producer clients to automatically failover to a secondary cluster when their local cluster becomes unavailable, without requiring DNS-level failover or application-level detection logic.