feat(services/swift): add Keystone v3 authentication

[benroeder]

Summary

• Fixes feat: Swift service should support Keystone v3 authentication #7215
• Add native Keystone v3 password authentication with automatic token acquisition and refresh
• Tokens are refreshed with a 2-minute grace period before expiry
• Swift storage URL can be discovered from the Keystone service catalog or provided explicitly
• Two auth modes: static token (existing, backward compatible) or Keystone v3 (new)
• New config fields: auth_url, username, password, project_name, user_domain_name, project_domain_name
• Adds mea dependency for async mutex (same as other OpenDAL services)
• Includes 9 unit tests for catalog extraction, response parsing, and signer lifecycle

Reference: https://docs.openstack.org/keystone/latest/api_curl_examples.html

Test plan

• All 93 behavior tests pass with Keystone v3 auth against a real OpenStack Swift cluster
• All 93 behavior tests pass with static token against local SAIO (backward compatibility)
• Unit tests cover: catalog extraction (normal, missing, trailing slash, prefers public), Keystone response parsing (full and minimal), timestamp parsing, static signer never-expire, Keystone signer starts-expired

[dosubot]

Related Documentation

Checked 0 published document(s) in 1 knowledge base(s). No updates required.

^{How did I do? Any feedback?}  

[Xuanwo]

I suggest we implement that logic within reqsign: https://github.com/apache/opendal-reqsign. This way, OpenDAL can focus more on storage-side logic.

[benroeder]

Ok will look into it

[benroeder]

I see that opendal uses v0.16.x branch and main is v0.19.0 should I add it to both ? @Xuanwo

[benroeder]

Update: I've submitted both PRs to opendal-reqsign:

• v0.16.x (what OpenDAL currently uses): feat(openstack): Add Keystone v3 authentication support opendal-reqsign#691
• main (v0.19.0): feat: Add OpenStack Keystone authentication service opendal-reqsign#690

Both add services-openstack with Keystone v3 password auth, token
caching, service catalog parsing, and request signing. Tested against
a real Keystone cluster.

Once the v0.16.x PR is merged and released, I'll update this PR to
use reqsign for the auth instead of the inline implementation.