Support catalog vended credentials

[vustef]

2 mechanisms are supported:

• loading credentials through load_table_credentials API call.
• loading credentials along table, through load_table_with_credentials call.

Test is added but ignored, since it depends on Polaris catalog, which is not available in this repo. I used to verify manually that things work (having spawned Polaris catalog in a separate shell). Here's what happens with iceberg-rest-fixture instead:

Context:
   status: 400 Bad Request
   headers: {"date": "Fri, 26 Dec 2025 09:48:16 GMT", "content-type": "application/json", "content-length": "145", "server": "Jetty(11.0.26)"}
   json: {"error":{"message":"No route for request: GET v1/namespaces/test_credentials_ns/tables/t1/credentials","type":"BadRequestException","code":400}}

So far, this works for s3 credentials. Azure credentials have this issue: apache#1442.

[vustef]

I'll merge this as is, to be able to make progress while people are on holidays. Will accept post-hoc reviews.

[vustef]

not sure if this should be part of the Catalog trait...