Add OAuth PKCE auth for Apps uploads

[otorrillas]

Summary

• add OAuth Authorization Code + PKCE support for Apps bundle uploads
• store and refresh OAuth tokens through OS credential storage
• move upload auth selection to auth.method with optional auth.oauthOptions
• send OAuth uploads with Authorization: Bearer while preserving API/app key uploads

Verification

• yarn workspace @dd/apps-plugin typecheck
• yarn workspace @dd/core typecheck
• yarn workspace @dd/factory typecheck
• yarn workspace @datadog/vite-plugin typecheck
• yarn workspace @dd/tests test:unit packages/plugins/apps/src/validate.test.ts packages/plugins/apps/src/index.test.ts packages/plugins/apps/src/oauth.test.ts packages/plugins/apps/src/upload.test.ts packages/core/src/helpers/request.test.ts --watchman=false
• yarn workspace @dd/tests test:unit packages/plugins/apps/src/vite/index.test.ts packages/plugins/apps/src/vite/dev-server.test.ts --watchman=false
• yarn workspace @datadog/vite-plugin build
• ESLint / Prettier checks on touched files
• CJS bundle sanity check: native import("oauth4webapi"), no require("oauth4webapi"), no new Function

[datadog-prod-us1-4]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 490c3f3 | Docs | Datadog PR Page | Give us feedback!}

[yoannmoinet]

Doing a quick review first, to tackle my biggest comments 😃

[yoannmoinet]

This should be factorised around the doRequest helper as much as possible.

What if another plugin needs to do oauth, will they have to re-implement most of this? (honest question, not rhetorical 😄)

[yoannmoinet]

Why's this user facing? Not sure I understand the need for it, from the user's perspective.

[yoannmoinet]

I believe this should be more of the form:

Suggested change

	auth?: Pick<AuthOptions, 'apiKey' | 'appKey' | 'accessToken'>;
	auth?: Assign<Pick<AuthOptions, 'apiKey' | 'appKey'>, { accessToken: string }>;

So accessToken isn't leaked into user facing API (unless we actually need it there).

[yoannmoinet]

This won't be necessary with my previous comment.