feat: use pgwire auth mechanisms API to simplify startuphandler (#9634)

* feat: use pgwire auth mechanisms API to simplify startuphandler

* chore: update pgwire

* chore: update pgwire revision to merged one

* refactor: model based on upstream api

* refactor: simplify implementation by introducing authsource

* refactor: update to latest pgwire apis

* refactor: adopt pgwire api changes

* chore: switch to released pgwire

* test: harden pg scram mixed-auth integration test and reject channel-binding clients

- Fix MixedAuthProvider to return a SCRAM verifier for the denied user,
  so the test exercises rejection by authorization after successful
  SCRAM verification; record the selected mechanism from the returned
  variant and assert authorize ran exactly once per verified user.
- Assert the denied connection fails with 28P01 before any terminal
  message, protecting the completion-ordering introduced by pgwire's
  authentication gate.
- Add a raw-protocol test proving a client-first with a p= channel
  binding flag is rejected (RFC 5802 section 6), while n-flag clients
  (tokio_postgres) continue normally.

Bump pgwire to 0.42.1, which enforces RFC 5802 channel binding
negotiation and rejects short/overlong SCRAM proofs on the verifier
path (sunng87/pgwire#476).

Signed-off-by: Ning Sun <sunning@greptime.com>

---------

Signed-off-by: Ning Sun <sunning@greptime.com>

src/auth/src/common.rs

@@ -361,6 +361,18 @@ impl PgScramSha256Verifier {
         &self.salt
     }
 
+    /// `SHA256(ClientKey)`, used to verify the client proof in SCRAM.
+    pub fn stored_key(&self) -> &[u8] {
+        &self.stored_key
+    }
+
+    /// `HMAC(SaltedPassword, "Server Key")`, used to compute the SCRAM
+    /// server signature. This is secret material and must not be exposed to
+    /// clients.
+    pub fn server_key(&self) -> &[u8] {
+        &self.server_key
+    }
+
     pub fn verify_plain_password(&self, password: &[u8]) -> Result<bool> {
         let salted_password =
             pg_scram_sha256_salted_password(password, &self.salt, self.iterations)?;