fix(auth): secure first-class X.509 workload credentials (#2479)

## Summary

- Add first-class SDK-owned `workloadIdentity.fromX509(...)` credentials
accepted by `new OpenAI({ credential })`, with explicit credential
ownership, independently scoped target/proxy TLS trust, certificate/key
validation, and fail-closed legacy transport verification.
- Repair the documented `openai/auth` CommonJS and ESM entrypoints while
preserving optional Undici isolation and blocking private
credential-state package subpaths.
- Honor canonical X.509 `refreshBufferSeconds`, retain the deprecated
`refreshBufferMs` compatibility alias, and reject conflicting or
malformed refresh settings.
- Keep asynchronous protected retry hooks outside the X.509 network
timeout while preserving one shared issuer/API/backoff deadline and
secure cloning between ordinary, provider, and credential clients.
- Update canonical authentication documentation and the runnable mTLS
example; add genuine public-entrypoint mTLS, transport/privacy, proxy,
cancellation, clone, historical Undici, and packed-artifact regressions.

## Verification

- `./scripts/test`: **6,573 handwritten + 556 generated tests passing**.
- Node **22.23.2** and **26.7.0**: **410 focused X.509 tests passing on
each runtime**; current Node full suite passing.
- All **14 ecosystem integrations passing**, including browser/Webpack,
Cloudflare Workers, Vercel Edge, Bun, Deno, CJS, and ESM.
- Actual packed npm artifact on Node 22: CJS/ESM exports, optional-peer
absence, private-subpath isolation, and **281/321 source checks across
1,282 source maps** passing.
- Actual Undici **5.5.1, 5.29, 6.28, and 7.29**: direct, HTTP CONNECT,
and HTTPS CONNECT compatibility verified; Undici **5.2** direct
supported and unsupported proxy metadata rejected safely.
- `pnpm lint`, `pnpm exec tsc --noEmit`, `pnpm build`, and TypeScript
**4.9** declaration checking passing.
- Trusted Castiron custom-code budget: **2,974 / 3,000**; no ratchet
increase or policy change.
- Two independent thermo-nuclear architecture/general/security reviews,
repeated after remediation and structural extraction, both clean.

## Compatibility and rollout

- Existing safe `createX509Transport(...)` integrations remain
supported; SDK-owned first-class credentials are the recommended secure
path.
- `refreshBufferMs` remains a deprecated compatibility alias;
simultaneous seconds/milliseconds options fail clearly.
- Undici remains an optional peer and unrelated/browser clients do not
import Node-only transport dependencies.