Epic: BYOIDC bearer-token authentication for `confluent_sql`

Confluent Cloud customers who run their **own** OAuth/OIDC identity provider need to authenticate this driver with a bearer token they mint themselves — an *external* token, in Confluent's authorization vocabulary — rather than a Confluent API key + secret. This epic covers that BYOIDC (bring-your-own-IdP) surface end to end, as small independently-shippable children.

### Scope boundary: Flink data plane only

By Confluent's authorization model (verified against the Cloud OpenAPI spec's per-operation `AUTHORIZATIONS` blocks), a raw external token authenticates the **Flink data plane** and nothing on `api.confluent.cloud`. None of `/tableflow/v1`, `/connect/v1`, `/cmk/v2/clusters`, or `/org/v2/organizations` accept `external-access-token`. So every child here is Flink-only, and the control plane fails closed with an error. Reaching the control plane with a caller identity is a *different* problem, covered in a separate epic, which mints Confluent's own tokens.

### The bar: cover plugin #399's BYOIDC half

The neighboring Java Table API client shipped two BYOIDC-flavoured modes in one large PR: a **static** `external-access-token` *and* a **refreshing client-credentials** provider. This epic covers the same ground as a *sequence* of bounded children rather than one mega-PR