@W-23493263 Add JWT Bearer authentication to Arrow Flight

[jakeichikawasalesforce]

Summary

Adds JWT Bearer authentication to TabPy's Arrow Flight (gRPC) path so OAuth-configured clients can use Flight. Companion to #664, which covers HTTP JWT authentication.

• Adds JwtAuthServerMiddlewareFactory, reusing jwt_auth.validate_jwt; failures surface as gRPC UNAUTHENTICATED.
• Registers the JWT factory when OAuth is enabled and delegates Basic credentials through it when a password file is configured.
• Keeps the Basic-only Flight path when OAuth is disabled and allows OAuth-only Arrow startup.
• Makes Flight Basic usernames case-insensitive, matching the HTTP authentication path.
• Accepts Basic-issued opaque Bearer tokens until its one-hour expiry or server restart. TabPy normally retains one token per username and permits a bounded two-token overlap during near-expiry rotation so existing clients are not disconnected.
• Single-flights cold and expired JWKS fetches per URI while warm cached-key validation remains nonblocking.
• Coordinates forced refreshes so concurrent requests for the same newly rotated kid share the result, while other unknown kids fail without starting additional fetches.
• Keeps unknown-kid matching and cooldown publication atomic and rate-limits repeated failed refreshes for 30 seconds.
• Rejects conflicting Flight Authorization values while accepting repeated copies of the same value.
• Documents Flight transport security, authentication behavior, JWKS caching, opaque-token lifetime, and revocation limitations.

Testing

• python -m pytest tests/unit -q: 196 passed
• Arrow integration suites: 6 passed
• Authentication-focused unit suites: 68 passed
• Real FlightClient transport coverage for valid JWTs, invalid JWTs, and required scopes: 3 passed
• flake8 on all changed Python files: passed
• Deterministic concurrency coverage for cold and expired single-flight fetches, same-kid refresh sharing, atomic cooldown publication, cooldown-expiry recovery, and warm-cache nonblocking behavior
• Independent review findings addressed; no known blockers

GUS: W-23493263