feat(yarn_client): auth config for YARN REST (none/simple/basic/kerberos)

Add per-Connection authentication so CDH 5 / Kerberos / HTTP Basic
clusters can be queried.

- auth_type: none / simple / basic / kerberos
- auth_user / auth_password for HTTP Basic
- auth_principal / auth_keytab stored for audit/display; actual SPNEGO
  handled by httpx-kerberos using the system Kerberos credential cache
- YarnClientConfig.auth_for_httpx() returns the right httpx.Auth object
- _request passes auth= through to httpx.request alongside verify=

New dependency: httpx-kerberos.

Tests cover none/simple (no auth object), Basic auth header,
Kerberos auth object, missing basic user, invalid auth_type, and
tool-layer config propagation.

spark_executor/tools/requests.py

@@ -24,6 +24,11 @@ class SaveConnectionRequest(BaseModel):
     spark_conf: dict[str, str] | None = None
     ssl_verify: bool | None = None
     ssl_ca_bundle: str | None = None
+    auth_type: str = "none"
+    auth_user: str | None = None
+    auth_password: str | None = None
+    auth_principal: str | None = None
+    auth_keytab: str | None = None
 
 
 class PrepareSubmitJobRequest(BaseModel):