feat(credprovider): a provider bounds how long the injector reuses its answer

[QuentinBisson]

Problem

The egress gateway's injector reuses a fetched secret for the same actor and URI for as long as it likes. A provider whose answer depends on who is acting on the actor right now (kagent answering with the token of the person whose turn runs) cannot say "this answer is good for this request only".

Change

FetchSecretResponse.max_age: unset keeps the injector's default, zero makes it fetch again for every request, and no injector reuses an answer past its own default. atenet's Go injector keeps no cache, so it already honours zero; agentgateway's cache honours the field in giantswarm/agentgateway-upstream#37. Towards giantswarm/giantswarm#38056.

[QuentinBisson]

Parked: git as the person is postponed. Upstream Substrate is redesigning this area (actor JWT injection merged in agent-substrate#1960, token exchange of the actor JWT in agent-substrate#1661, the actor JWT contract in agent-substrate#1756), which likely supersedes this provider design, and this fork line has to re-pin past agent-substrate#1809 before it can follow. Kept as a draft so it can resume in place; tracking in giantswarm/giantswarm#38064.