feat(sasl): add OAUTHBEARER mechanism (RFC 7628)

[pilat]

Implements OAUTHBEARER SASL authentication mechanism per RFC 7628.

Closes #238

Changes

• Add sasl/oauthbearer package with Mechanism type
• TokenFunc callback enables automatic token refresh on reconnection
• Structured Error type with errors.Is/errors.As support
• RFC 7628 compliant: returns 0x01 dummy response on auth failure
• Unit tests and integration tests against local Kafka

Design

Uses TokenFunc func(ctx context.Context) (string, error) callback instead of static token field. This allows token refresh when connections are re-established, which is essential for short-lived OAuth tokens.

Example usage:

mechanism := &oauthbearer.Mechanism{
    TokenFunc: func(ctx context.Context) (string, error) {
        return getTokenFromProvider(ctx)
    },
}

Testing

• Unit tests cover all code paths
• Integration tests run against Kafka with unsecured OAUTHBEARER mode
• Docker-compose updated to expose OAUTHBEARER listener on port 9094