feat(clickpipes): add GCP workload identity

[sdairs]

Closes #690

Summary

• add cloud clickpipe context get so users can inspect a service's GCP workload-identity principal with API-key or OAuth authentication
• add typed SERVICE_ACCOUNT_WORKLOAD_IDENTITY request variants for GCMK Kafka, GCS object storage, Pub/Sub, and BigQuery creates, plus every supported schema-discovery source
• reject provider and credential conflicts before HTTP while preserving the existing service-account and source-specific authentication paths
• document the context, IAM grant, and ClickPipe creation flow

Validation

• cargo fmt --all -- --check
• CARGO_TARGET_DIR=/tmp/chctl-690-target cargo clippy -p clickhousectl -- -D warnings
• CARGO_TARGET_DIR=/tmp/chctl-690-target cargo check -p clickhousectl --no-default-features
• CARGO_TARGET_DIR=/tmp/chctl-690-target cargo clippy -p clickhousectl --all-targets --no-default-features -- -D warnings
• cargo test -p clickhousectl (one unrelated local-server port collision;
  the exact failed binary and all remaining binaries passed on rerun)
• focused ClickPipes unit and wiremock tests with
  CARGO_TARGET_DIR=/tmp/chctl-690-target

[iskakaushik]

LGTM