[rust] Support SASL/PLAIN authorization identity

[beryllw]

Search before asking

• I searched in the issues and found nothing similar.

Description

FIP-49 user/act-as mode requires the Rust client to authenticate with the Gateway service credential while sending the authenticated HTTP principal as a separate SASL/PLAIN authorization identity. This task:

• adds an optional SASL/PLAIN authorization identity to the Rust client without changing the existing authentication identity;
• preserves the current wire behavior when the authorization identity is not configured;
• covers omitted, empty, and non-empty authorization identities in SASL/PLAIN encoding tests;
• redacts the authentication identity, authorization identity, and password from errors and logs; and
• adds a fixed-version real-cluster test for allowed and denied impersonation against the server implementation from Support impersonation via SASL/PLAIN authorization id #3837/[security] Support impersonation via SASL/PLAIN authorization id #3857.

Willingness to contribute

• I'm willing to submit a PR!