Add retry logic to token acquisition for auth credentials

[renaudhartert-db]

Summary

Token acquisition for OIDC, M2M OAuth, and Azure client secret credentials
now retries on transient failures with Retry-After header support. Retries
happen at the token source level (application layer) rather than the HTTP
transport level, sidestepping the body-rewind problem that caused #1398.

Why

The SDK's ApiClient.RoundTrip retries failed requests at the transport
level, violating the http.RoundTripper contract. This is what led to #1398:
the oauth2 library wraps request bodies in a non-seekable reader, and when
the transport retry tries to rewind the body, it fails with "cannot reset
reader".

A related problem is #1072: OIDC token endpoint errors like
TEMPORARILY_UNAVAILABLE were never retried because token acquisition
bypasses the SDK's retry middleware entirely.

By retrying at the application level, each attempt calls Token() on the
underlying source, creating a fresh HTTP request from scratch. No body to
rewind.

Retriable status codes

Code	Name	Rationale
429	Too Many Requests	Rate limiting from the IdP.
502	Bad Gateway	Gateway could not reach the upstream token service. Common during rolling deployments.
503	Service Unavailable	Token service temporarily overloaded or down.
504	Gateway Timeout	Gateway timed out waiting for the upstream. Addresses #1102.

Transient network errors are also retried: ECONNRESET, ECONNREFUSED, and
timeouts.

Retry-After

For retriable HTTP errors, the Retry-After header is used as a hint: the
delay is max(backoff, Retry-After), so we never retry sooner than the
server asked. No upper cap is applied -- the context timeout already bounds
total retry duration. Retry-After is intentionally NOT treated as a
retriability signal: a 400 with Retry-After is still not retried.

What changed

Interface changes

• auth.NewRetryingTokenSource(inner, opts...) -- wraps any auth.TokenSource with retry logic. Exponential backoff, 1-minute timeout by default.
• api.ExecuteWithResult[T](ctx, fn, opts...) -- generic retry executor in experimental/api/.
• (*httpclient.HttpError).HTTPStatusCode() -- exposes the status code for error classification without import cycles.
• (*httpclient.HttpError).Header() -- exposes headers for Retry-After parsing without import cycles.

Behavioral changes

• OIDC, M2M OAuth, and Azure client secret token acquisition now retry on 429, 502, 503, 504, and transient network errors.
• Retry-After header is respected on retriable responses (HTTP response Retry-After header value is not respected #767).

Internal changes

• httpRetrier in config/experimental/auth/retry.go classifies errors and determines retry delay, including Retry-After parsing.
• httpResponseError interface unifies status code and header extraction from errors, avoiding import cycles with httpclient.
• httpResponse() extracts metadata from both oauth2.RetrieveError and SDK HttpError types.
• All three credential providers wrap their token sources with NewRetryingTokenSource.

How is this tested?

• TestRetryingTokenSource -- integration test: retry on 429/503/network errors, no retry on 400/401.
• TestHTTPRetrier_IsRetriable -- exhaustive retriability classification for all status codes and error types.
• TestHTTPRetrier_RetryAfterDelay -- Retry-After raises delay above backoff, not capped by backoff maximum.
• TestParseRetryAfter -- seconds, zero, negative, non-numeric, HTTP-date in the past.
• TestExecuteWithResult -- timeout, retry, and success paths.

Issues

Fixes #1398 -- OIDC auth retries fail with "cannot reset reader"
Fixes #1072 -- OIDC token endpoint TEMPORARILY_UNAVAILABLE not retried
Partially addresses #767 -- Retry-After header respected for token acquisition

Related: #1102 (504 now retriable)

NO_CHANGELOG=true

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-go

Inputs:

• PR number: 1602
• Commit SHA: 6a37d89c877e4489949607095f4a6e0206668483

Checks will be approved automatically on success.