feat(secureservice): carry admission tokens

[ZanzyTHEbar]

Summary

• Add an additive Credentials.admissionToken handshake field and regenerate protobuf/vtproto outputs.
• Propagate remote admission tokens through handshake.Result and secureservice post-handshake contexts.
• Add outbound/remote context helpers and copy credentials before injecting outbound tokens to avoid mutating cached credentials.

Stack

• Third PR in the federated admission stack.
• Depends conceptually on feat(secureservice): add admission primitives #680 and feat(secureservice): add JWT admission verifier #681.
• Draft until the lower stack lands; review as the delta after feat(secureservice): add JWT admission verifier #681.

Security

• Transport-only change: tokens are carried but not validated or enforced yet.
• Outbound and remote token context keys are split to avoid replaying a remote peer's bearer token on a later outbound handshake.
• Existing deployments continue to send no token by default.

Validation

• PASS: go test ./net/secureservice ./net/secureservice/handshake
• PASS: go test ./... -run '^$'
• PASS: worktree review found no findings after the context split.
• KNOWN PRE-EXISTING FAIL: go test ./... still fails at net/rpc/limiter TestLimiter_Concurrent_Bursts with 40 <= 38, matching the unrelated failure observed before this stack.

[ZanzyTHEbar]

/oc please review this draft stacked PR, focusing on the delta after #681