Add cluster-level automatic failover support (AutoClusterFailover)

**Summary**

The C++ client does not support cluster-level failover — the ability for a Pulsar client to automatically switch from a primary cluster to a secondary cluster when the primary becomes unavailable.

**Context**

The Java client has supported this since Pulsar 2.10 (May 2022) via `AutoClusterFailover` and `ControlledClusterFailover`, both built on the `ServiceUrlProvider` abstraction. The .NET client (Pulsar.Client) has also independently implemented equivalent functionality via `IServiceInfoProvider`. The C++ client still lacks this capability. Since the C++ client is the foundation for several language bindings (Node.js, Python), this gap propagates across multiple client ecosystems. Adding cluster-level failover here would bring the C++ client to parity with Java and unblock the same capability in downstream clients.

**Proposed Behavior**

1. A `ServiceUrlProvider` (or equivalent) abstraction that allows pluggable URL resolution.
2. An `AutoClusterFailover` implementation that:
- Accepts a primary service URL and one or more secondary service URLs.
- Runs a background probe task at a configurable `checkInterval` (default: 30s).
- Switches to the first healthy secondary if the primary is unreachable for longer than `failoverDelay` (default: 30s).
- Switches back to the primary once it recovers and stays healthy for `switchBackDelay` (default: 60s).
- Supports per-cluster authentication and TLS configuration.

**Use Case**

Pulsar deployments with geo-replication across multiple regions need producer clients to automatically failover to a secondary cluster when their local cluster becomes unavailable, without requiring DNS-level failover or application-level detection logic.

首先比较 Java 的 AutoClusterFailover 和 ControlledClusterFailover 实现，以及 issue 中提到的 .NET IServiceInfoProvider 设计。定义 C++ ServiceUrlProvider 抽象和 failover 行为，包括健康检查、延迟、身份验证和 TLS；当 primary-to-secondary 切换和恢复均由测试覆盖时，即表示完成。

由索引模型根据 Issue 内容生成。