refactor: Move SensitiveBytes and Credential into shared module

[DerGut]

Which issue does this PR close?

Fixes #2972

This is derived from a thread in #2836 (comment) and from @plusplusjiajia's original implementation on #2838. There's three issues I see with the freshly introduced iceberg::catalog::session::Credential type:

1. the naming of Credential already exists in the context of credential vending (see iceberg_catalog_rest::StorageCredential - but in Java it's plain Credential). A new Credential concept meaning "any sensitive string" conflicts with it
2. use cases exist for a sensitive string type outside of catalog credentials, like FileIO properties (e.g. s3.session-token): iceberg::catalog is the wrong place to share it
3. The existing (and analogous) iceberg::encryption::SensitiveBytes type is located somewhere completely different, making it non-obvious that both exists and share semantics

What changes are included in this PR?

This PR moves the recently introduced (and unreleased) Credential type to a separate iceberg::sensitive module and colocates it with the existing iceberg::encryption::SensitiveBytes.

Are these changes tested?

I added two new tests to assert the redaction behavior of the SensitiveBytes type and a third test to assert that imports of SensitiveBytes by its old location remain backwards-compatible.

AI Disclosure

I used AI to rubber-duck approaches and rebase my PR onto latest main.

[xanderbailey]

This refactor makes sense to me and the import for sensitive bytes is maintained from the encryption mod so I'm happy with this change! Thanks!