feat(metrics): support Basic authentication for Prometheus endpoint

[BackendArchitectX]

Fixes #3573

Why

The built-in Prometheus endpoint currently allows any client with network access to scrape /metrics. This change adds optional in-process HTTP Basic authentication while preserving the existing unauthenticated behavior by default.

What

• Add optional Basic authentication for /metrics and /metrics/...
• Keep authentication disabled by default for backward compatibility
• Keep / and /-/healthy public
• Add broker configs for auth type, username, and password
• Keep credentials outside s3.telemetry.metrics.exporter.uri
• Register the password as a Kafka PASSWORD config
• Propagate an optional authenticator through the telemetry path
• Upgrade OpenTelemetry to versions exposing PrometheusHttpServerBuilder#setAuthenticator
• Preserve existing Prometheus behavior with MemoryMode.IMMUTABLE_DATA
• Add authentication, configuration, endpoint-policy, and lifecycle tests

Configuration

s3.telemetry.metrics.prometheus.auth.type=none|basic
s3.telemetry.metrics.prometheus.auth.username=
s3.telemetry.metrics.prometheus.auth.password=

The default is none, so existing deployments remain unchanged. When basic is enabled, missing or invalid credentials return HTTP 401 and valid credentials can scrape metrics successfully.

OpenTelemetry compatibility

Upgrades OpenTelemetry SDK to 1.50.0, SDK/Prometheus alpha to 1.50.0-alpha, and instrumentation alpha to 2.16.0-alpha. Compatibility updates preserve existing metric cardinality, local JMX, GC metric shape, and Prometheus immutable-data behavior.

Security considerations

Basic authentication does not encrypt transport. Deployments crossing untrusted networks should continue to provide TLS through an ingress, reverse proxy, sidecar, or equivalent network control. Credential rotation is restart-based in this initial implementation.

Testing

Validated locally with :automq-metrics:test, :automq-metrics:check, AutoMQConfigTest, :core:checkstyleMain, :core:spotlessJavaCheck, jar -x test, rat, and git diff --check upstream/main...HEAD.

Coverage includes default unauthenticated scraping, missing credentials, wrong username/password, malformed Base64, wrong auth scheme, successful authenticated scraping, /metrics/... protection, public root/health endpoints, config validation, and exporter shutdown/port release.

Committer Checklist (excluded from commit message)

• Verify design and implementation
• Verify test coverage and CI build status
• Verify documentation (including upgrade notes)