Support bearerToken for BYO-K

### Describe the feature or problem you'd like to solve

In corp context, key based auth is disabled per compliance requirements. BearedToken based auth or customized broker would be helpful to automate the CLI runs.

### Proposed solution

Similar as what have been offered in GitHub Copilot SDK.
https://docs.github.com/en/copilot/how-tos/copilot-sdk/auth/byok#providerconfig-fields

field| type| description
-- | -- | --
bearerToken / bearer_token | string | Bearer token auth (takes precedence over apiKey)
bearerTokenProvider / bearer_token_provider | callback | Returns a bearer token on demand (takes precedence over apiKey and bearerToken)

### Example prompts or workflows

_No response_

### Additional context

_No response_

Start by reading the existing CLI BYO-K configuration and apiKey authentication flow, then compare it with the linked GitHub Copilot SDK provider fields. Done means CLI runs can authenticate with bearerToken or bearerTokenProvider, with those options taking precedence over apiKey.

Written by the indexing model from the issue text.