feat(yarn_client): auth config for YARN REST (none/simple/basic/kerberos)

Add per-Connection authentication so CDH 5 / Kerberos / HTTP Basic
clusters can be queried.

- auth_type: none / simple / basic / kerberos
- auth_user / auth_password for HTTP Basic
- auth_principal / auth_keytab stored for audit/display; actual SPNEGO
  handled by httpx-kerberos using the system Kerberos credential cache
- YarnClientConfig.auth_for_httpx() returns the right httpx.Auth object
- _request passes auth= through to httpx.request alongside verify=

New dependency: httpx-kerberos.

Tests cover none/simple (no auth object), Basic auth header,
Kerberos auth object, missing basic user, invalid auth_type, and
tool-layer config propagation.

spark_executor/tools/connections.py

@@ -17,6 +17,11 @@ def save_connection(
     spark_conf: dict[str, str] | None = None,
     ssl_verify: bool | None = None,
     ssl_ca_bundle: str | None = None,
+    auth_type: str = "none",
+    auth_user: str | None = None,
+    auth_password: str | None = None,
+    auth_principal: str | None = None,
+    auth_keytab: str | None = None,
 ) -> dict[str, str]:
     logger.debug(
         f"save_connection enter name={name} master={master} deploy_mode={deploy_mode} "
@@ -30,6 +35,11 @@ def save_connection(
         spark_conf=spark_conf or {},
         ssl_verify=ssl_verify,
         ssl_ca_bundle=ssl_ca_bundle,
+        auth_type=auth_type,
+        auth_user=auth_user,
+        auth_password=auth_password,
+        auth_principal=auth_principal,
+        auth_keytab=auth_keytab,
     )
     store.save(conn)
     return {"name": name, "status": "SAVED"}