Add portal dry-run submit and mTLS API auth

[yoshifuminakamura]

Summary

• add admin execution profile dry-run submit planning for GitLab Pipeline API
• add mTLS trusted-proxy authentication for result ingest/query APIs
• switch result server helper scripts to client cert/key auth without X-API-Key

Deployment notes

• dev2 has been configured with RESULT_SERVER_TRUSTED_PROXY_AUTH=mtls and no RESULT_SERVER_KEY(S)
• nginx dev2 ingest/query locations require verified client certificates
• self-managed Docker runners mount /etc/benchkit/result-server read-only and set RESULT_SERVER_CLIENT_CERT/KEY

Validation

• pytest result_server/tests/test_execution_profiles.py result_server/tests/test_api_routes.py result_server/tests/test_preflight.py
• bash -n scripts/result_server/send_results.sh scripts/result_server/send_estimate.sh scripts/result_server/api.sh scripts/estimation/test_reestimate.sh scripts/estimation/result_query.sh
• dev2 HTTPS smoke: no cert -> 403, runner-equivalent Docker mTLS -> 200