feat: add auth related base classes

[kalenkevich]

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

2. Or, if no issue exists, describe the change:

Problem:
The TypeScript SDK was missing several authentication abstractions and features required to align with other language implementations (like the Python ADK). Specifically, it lacked a standard way to manage multiple authentication providers, stateful credential services for persisted sessions, and credential refreshers. Furthermore, BaseCredentialExchanger did not report whether a credential was actually exchanged or just passthrough.

Solution:
Implemented several new authentication utilities and components to extend the authentication infrastructure within core/src/auth/ and unified them via common.ts exports:

1. BaseCredentialExchanger Refactor: Updated the exchange method to return an ExchangeResult interface (contains the credential and a wasExchanged flag), allowing callers to track whether state changes occurred.
2. Added AuthProviderRegistry and BaseAuthProvider: Centralized registry for managing authentication providers of different schemes.
3. Added SessionStateCredentialService: For loading/saving credentials from state (enabling persisted tool sessions).
4. Added CredentialRefresherRegistry and BaseCredentialRefresher: For managing run-time credential renewal.
5. Updated HttpAuth & ServiceAccount: Added support for additionalHeaders and OIDC identity tokens (supporting useIdToken and audience).
6. Added Comprehensive Unit Tests: Created thorough test suites for AuthHandler, AuthProviderRegistry, AuthSchemes, InMemoryCredentialService, SessionStateCredentialService, and CredentialRefresherRegistry.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Unit tests pass via npm run test for the auth suite.

Manual End-to-End (E2E) Tests:

Not applicable for this structural PR; verification was performed via unit tests and validation of type-safety.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

Additional context

This PR establishes the foundation for more advanced authentication modules (such as Google/REST API handlers) by providing unified registries and stateful services.

[ScottMansfield]

LGTM with some minor comments.