Add client-to-proxy authentication support

[rogerb-ds]

Summary

Adds optional CQL authentication between clients and the proxy so that clients can be required to present credentials before traffic is forwarded to the backend.

Changes

proxycore/proxyauth.go (new)

• ProxyAuthenticator interface: MessageForStartup() and HandleAuthResponse()
• noopProxyAuth: default; responds READY to STARTUP (no auth)
• fakeProxyAuth: sends AUTHENTICATE then AUTH_SUCCESS for drivers that expect the PasswordAuthenticator handshake but accepts any credentials
• passwordProxyAuth: real auth; validates credentials from CredentialStore
• CredentialStore: in-memory username/password store with LoadFromEnv() for CQL_CREDENTIALS (format USERNAME=password,USER2=pass2), SHA-256 hashing

proxy/proxy.go

• Config.ProxyAuth: optional ProxyAuthenticator
• On STARTUP: send ProxyAuth.MessageForStartup() or Ready when nil
• New case for AuthResponse: delegate to ProxyAuth.HandleAuthResponse(), send AuthSuccess or error; reject AuthResponse when ProxyAuth is nil
• Fix missing return after sending compression error

proxy/run.go

• runConfig: --fake-auth (FAKE_AUTH) and --client-auth (CLIENT_AUTH)
• Wire ProxyAuth: noop by default; fake-auth => FakeProxyAuth; client-auth => PasswordProxyAuth with CredentialStore from CQL_CREDENTIALS
• Log warning when client-auth is on but no credentials loaded

Usage

• No auth (default): unchanged behaviour; proxy responds READY to STARTUP.
• Fake auth: --fake-auth for clients that require an auth handshake; proxy mimics PasswordAuthenticator and accepts any credentials.
• Real client auth: --client-auth and set CQL_CREDENTIALS (e.g. USER1=pass1,USER2=pass2); proxy validates before forwarding.

Credits

Based on the approach from the handle-client-auth branch in this repository.