Extract DCR resolver into pkg/auth/dcr

Sub-issue 4a of #5145. Creates the shared pkg/auth/dcr package and
migrates the embedded authserver to consume it. The CLI flow migration
(pkg/auth/discovery::PerformOAuthFlow) is left to a follow-up so this
slice stays under the project's PR-size limit.

Files moved (renamed via git mv so the diff shows as renames, not
deletions + additions):

  pkg/authserver/runner/dcr.go         -> pkg/auth/dcr/resolver.go
  pkg/authserver/runner/dcr_store.go   -> pkg/auth/dcr/store.go
  pkg/authserver/runner/dcr_test.go    -> pkg/auth/dcr/resolver_test.go
  pkg/authserver/runner/dcr_store_test.go -> pkg/auth/dcr/store_test.go

Public API surface (renamed from runner-package internals because they
now cross a package boundary):

  Resolution            (was DCRResolution)
  Key                   (was DCRKey, alias to storage.DCRKey unchanged)
  CredentialStore       (was DCRCredentialStore)
  ResolveCredentials    (was resolveDCRCredentials)
  NeedsDCR              (was needsDCR)
  ConsumeResolution     (was consumeResolution)
  ApplyResolutionToOAuth2Config (was applyResolutionToOAuth2Config)
  LogStepError          (was logDCRStepError)
  NewInMemoryStore      (was NewInMemoryDCRCredentialStore)
  NewStorageBackedStore (was newStorageBackedStore)

Names follow the pkg/auth/dcr.* form so the linter's stuttering check
(revive: dcr.DCRResolution would stutter) passes and the surface reads
as ordinary package API.

resolveSecret was duplicated into the dcr package because pkg/auth/dcr
must stay profile-agnostic and cannot reach back into pkg/authserver/
runner. The duplication is intentional and called out in a comment;
future consolidation can move it into a shared helper if a third
caller appears.

Acceptance criteria status (#5145):

  AC#1 (pkg/auth/dcr exists, exports a stateful resolver, consumed by
       both call sites): partially met — package exists and is consumed
       by EmbeddedAuthServer. CLI flow migration is sub-issue 4b.
  AC#2 (stateless RFC 7591 helpers in pkg/oauthproto): met (already
       satisfied before this PR).
  AC#3 (no direct oauthproto.RegisterClientDynamically calls outside
       pkg/auth/dcr): not yet met — pkg/auth/discovery still calls it.
       Resolved by sub-issue 4b.
  AC#4 (review-property behaviours apply to CLI flow): not yet met —
       same dependency on 4b.

Verified via task lint-fix (0 issues), go test -race ./pkg/auth/dcr/...
./pkg/authserver/... (all pass), and task license-check (clean).

Author: tgrunnagle