Extensible authentication mechanism of clangd clients on clangd-index-server

@ArcsinX, as discussed in https://discourse.llvm.org/t/rfc-clangd-tls-and-kerberos-auth-for-remote-index-client/91413/8 in corporate scenarious it's necessary to authenticate clients on backends so the following feature is going to be implemented.

Thin extensions:
1. Option `--remote-index-token-command=` for `clangd` which configures an external command to obtain some abstract auth token (say `ADFS/JWT`). The command should be run on process initialization and periodically by refresh timeout depending on cached token's TTL and `401/UNAUTHENTICATED`.

2. Option `--remote-index-keys-command=` for `clangd-index-server` which configures an external command to obtain public keys documents from auth service (say `ADFS/JWKS`). The command should be periodically run to fetch a `JWKS` document and cache the public keys in-process. Inbound `JWT`s are verified in-process. Signature verification uses the `OpenSSL/BoringSSL EVP API` already linked transitively through grpc++.

Refresh timeout backoff is necessary to exclude DoS-like issues.

Start with the clangd and clangd-index-server entry points for the proposed remote-index token and keys command options, then read the related gRPC client and server authentication flow. Done means supporting token and public-key retrieval, refresh behavior with backoff, cached verification, and the documented unauthenticated response handling.

Written by the indexing model from the issue text.