[milestone] basic OAuth support

Most of this work is still blocked by upstream work by the Control Plane IAM team to support the OAuth flows needed.

## Scope

- **Elastic Cloud Serverless only**; OAuth support for self-managed Elasticsearch instances will require separate effort from Kibana and/or Elasticsearch security teams
- support for both browser- and PKCE-based auth flows
- global scope only; granular scope support comes later
- auth may

## Functional requirements

- auth commands: `elastic auth login`, `elastic auth status`, `elastic auth logout`
- user will need to enter a single project URL at login time
- OAuth tokens should be stored using the existing `SecretStore` implementation
- If an OAuth token needs to be refreshed, CLI should silently do this in the background before continuing
- If auth tokens are expired, relevant secrets should be deleted from the store so that the next `login` starts in a clean state.
- `logout` deletes any locally stored secrets
- `status` shows basic info about whether or not the session is logged in, potentially displaying an account display name/project name and/or ID. **NO secrets or tokens are ever printed to stdout or stderr.**