feat(ios): sign in with AWS IAM and Google Cloud IAM on iPhone and iPad

[datlechin]

Summary

• iOS reads the connection's IAM sign-in method for MySQL, MariaDB, PostgreSQL and Redis and signs a fresh token on every connect, before the SSH tunnel opens. The token is never stored. As on the Mac, an RDS or Cloud SQL connection with SSL off connects with Required, and Redis with SSL off says IAM needs TLS.
• AWS IAM (Access Key) and Google Cloud IAM (Service Account) use keys stored under the same Keychain names as the Mac, so Sync Passwords brings them over.
• AWS IAM (Profile) and Google Cloud IAM (Application Default) need files on the Mac. The form offers an access key or service account key for this device only. It is stored device-only and never syncs, and the Mac's connection does not change.
• AWS IAM (SSO) signs in to IAM Identity Center on the device with the device authorization flow. Account and Role come from pickers. The SSO token stays on the device.
• Connection form: a new Authentication section with the Mac's method names. The password row is hidden when an IAM method is chosen. A JSON key can be pasted or picked from Files.
• IAM failures get their own titles and an Edit Connection action instead of "Check your username and password".
• The RDS token signer moves from the Mac app into TableProPluginKit (kit 40, additive) and both apps call AWSIAMTokenTarget. The Mac signs exactly as before.
• MySQL with a token refuses a server without TLS before auth, so a cleartext-password switch never gets the token.
• Fixed: an RDS host typed in capitals made AWS IAM fail to find the region, on both apps.
• Fixed: Verify Identity through an SSH tunnel on iOS checked the PostgreSQL and Redis certificate against 127.0.0.1.
• Fixed: a failed Microsoft Entra ID sign-in on iOS showed the original "sign-in required" error instead of why the sign-in failed.

Test plan

Fail on main, pass here:

• iOS: IAMPasswordMintTests, IAMSignInTests, ConnectionFormViewModelIAMTests, MySQLTokenSignInTests (a fake server that drops TLS and asks for cleartext never sees the token), IAMErrorClassifierTests, SignInOfferTests, PostgreSQLConnectionStringTests, RedisTLSOptionsMappingTests, DriverSSLConfigurationTests.
• TableProCore: ConnectionManagerSignInTests, RDSAuthTokenTests (fixed SigV4 vector, mixed-case hosts), AWSIAMTokenTargetTests, AWSSSOPortalTests, AWSSSOLoginTests.
• macOS: AWSIAMTokenSignerTests. The three AWSIAMAuthTests signer suites moved to RDSAuthTokenTests unchanged.
• ConnectionSecretsTests changes on purpose: it pins the new secret kinds and that the device-only item never syncs.
• PluginKit ABI check passes. Lint, l10n and plugins pass.
• Simulator, iOS 27: a Profile connection shows the new error with Edit Connection; an Access Key connection's form shows the Authentication section. Not run against a real RDS or Cloud SQL instance.

	Before	After
Access Key form, light
Access Key form, dark
Profile connection, light
Profile connection, dark
Profile form

Not in this PR

• Mac MySQL IAM sends the token over Require without checking that TLS came up. Fixing it changes Mac behavior.
• iOS MySQL Require with a password still falls back to plaintext when the server drops TLS. Enforcing it needs a Preferred mode first, since the Mac's Preferred decodes to Require on iOS.
• iOS MySQL Verify Identity behind an SSH tunnel checks the chain but not the host name: Connector/C treats 127.0.0.1 as local.
• Oracle Verify Identity behind an iOS tunnel may hit the same 127.0.0.1 name (not verified).
• PluginKit messages shown on iOS stay English.
• No SSO refresh token: the device signs in again when the token expires, as the Mac does.

Docs: TableProApp/docs#59

Fixes #3638