feat: add reusable auth policy and OAuth steps

[intel352]

Summary

• add reusable auth primitives for password compatibility, challenge codes, phone normalization, auth method policy/audit, and OAuth provider/start/exchange/userinfo
• preserve BMW migration compatibility with provider_user, phone, and phone_valid aliases
• harden challenge verification with HMAC context binding and fail-closed attempt parsing
• constrain OAuth endpoint overrides to strict test mode or expected Google HTTPS hosts
• align plugin.json with wfctl validation requirements and add manifest validation to CI

Verification

• GOWORK=off go test ./... -count=1
• GOWORK=off go build ./cmd/workflow-plugin-auth
• wfctl plugin validate -file plugin.json
• git diff --check
• final adversarial review: SHIP-IT after fixes

Follow-up

After this merges, release v0.1.5, then update BMW to consume the public step.auth_* primitives and remove the duplicate BMW-local auth step implementations.