[OpAMP] Exchange initial API key (enrollment token) for per-Agent API key (access API key)

**Describe the enhancement:**

Implement a two-token authentication flow for OpAMP clients, analogous to the one used by Elastic Agent with Fleet Server today.

In this flow, OpAMP clients will send an API key when they first connect to Fleet Server. Let's call this the enrollment token. This enrollment token is expected to be shared amongst several OpAMP clients.

As each OpAMP client successfully enrolls with Fleet, i.e. a document for it is created in the `.fleet-agents` index so it shows up in the Fleet UI, a second API key, specific to this Agent, should be created by Fleet Server. Let's call this the access API key. This API key's ID should be stored in this Agent's document in `.fleet-agents`. The `ServerToAgent` response should set the `connection_settings.opamp.headers` field to `Authorization: ApiKey `. When Fleet Server receives requests from an OpAMP client, it should validate the received access API key by comparing it's ID with the ID stored in the corresponding Agent's document in `.fleet-agents`.

**IMPORTANT**: A two-token authentication flow for OpAMP requires that OpAMP clients support the `AcceptsOpAMPConnectionSettings` capability. Therefore, before going down the path described above, Fleet Server must first check if this capability is set in the `AgentToServer` message it receives from the OpAMP client. If it is not set, Fleet Server must continue to work as it does today, where the single, shared enrollment token API key is used for authentication for all OpAMP clients connecting to Fleet Server.

As of this writing, the OpAMP extension [does not have the ability](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/1e6b0b3ff821b3a65f33d53a871838c221c53f87/extension/opampextension/config.go#L72-L90) to support this capability. However, the OpAMP supervisor [does have the ability](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/1e6b0b3ff821b3a65f33d53a871838c221c53f87/cmd/opampsupervisor/supervisor/config/config.go#L156-L158) to support this capability.

**Describe a specific use case for the enhancement or feature:**

We want to have per-Agent access API keys — as opposed to a single API key that's shared amongst multiple Agents — so we can revoke access for a specific Agent.