[feature]: OAuth Integration

Note: This is an extension of https://github.com/goharbor/harbor-cli/issues/525 with key details of the Proposal

## Problem
Currently, harbor-cli only supports username/password authentication, requiring static credentials to be embedded in scripts, stored in environment variables, or entered interactively. This creates several challenges:

- Security risks: Static credentials in CI/CD pipelines increase credential leakage exposure
- No enterprise identity integration: Cannot leverage existing OIDC providers
- Manual credential rotation: Users must manually update passwords across all systems
- Poor CI/CD experience: Storing passwords in pipeline secrets is less secure than short-lived tokens

Harbor already supports OIDC authentication for its web UI and can validate OAuth tokens sent via Authorization: Bearer headers. The CLI should leverage this existing infrastructure.

## Proposed Solution
Implement OAuth/OIDC authentication for harbor-cli using the OAuth 2.0 Device Authorization Grant (RFC 8628), which is specifically designed for CLI tools and doesn't require callback URIs.

## User Workflows
Users on the CLI can authenticate interactively via device code and on Pipelines as well for CI/CD purposes.

### 1. Interactive Login (Device Code):
```bash
harbor-cli login https://harbor.example.com --sso
```

#### Example Device Code

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔐 Harbor CLI - OAuth Device Authentication
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
- Open this URL in your browser:
https://keycloak.company.com/device

- Enter this code when prompted:
WXYZ-1234

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⏳ Waiting for authorization...
✅ Success! Tokens saved securely.

### 2. CI/CD Login (Automated Pipelines):
```bash
# Pipeline obtains token from identity provider
echo $OIDC_TOKEN | harbor-cli login https://harbor.example.com --sso --token-file -
```

### Implementation Plan
**The implementation focuses on five core capabilities:**

**Get tokens from OAuth provider** - Implement device code flow for interactive login
**Accept tokens from users** - Support `--token-file` flag for CI/CD workflows
**Send tokens to Harbor API** - Add `Authorization: Bearer ` to all API requests
**Store tokens securely** - Encrypt tokens with AES-256-GCM in config file
**Refresh tokens automatically** - Detect expiry and transparently refresh using refresh tokens

## Additional Context
### New CLI Flags

```bash
# OAuth flags
--sso Enable OAuth authentication
--token-file Path to token file (use '-' for stdin)

# Configuration override flags
--issuer-url # OIDC issuer URL
--client-id # OAuth client ID
--client-secret # OAuth client secret (optional)
--scopes # Comma-separated scopes
```

### Configuration Format
```yaml
# ~/.config/harbor-cli/config.yaml
credentials:
- name: oauth@harbor.example.com
server-address: https://harbor.example.com
auth-type: oauth
oauth:
issuer-url: https://keycloak.company.com/realms/harbor
client-id: harbor-cli
client-secret: xxxxxxxx
scopes: [openid, profile, offline_access]
```