Add support for connecting via a Boundary tunnel

[rolandwalker]

Description

https://developer.hashicorp.com/boundary/docs/what-is-boundary

• Add CLI option --boundary-id.
• Add [boundary_beta] section to ~/.myclirc. When this is fully configured, the single CLI option is all that is needed to connect. Boundary issues temporary credentials, which are plugged in.
• Unless less_chatty is set, print a banner before connection showing the expiry time of the temporary connection.
• When --verbose --verbose is given, print the temporary credentials before entering the REPL. Usecase: making additional connections over the same tunnel.
• Allow boundary_id to be given in the query parameters of a DSN, and when connecting over a Boundary tunnel, return it in /dsn show by default.
• Respect password_sources precedence, where there was already a stub value, unused.
• Do not include boundary in keyring sources. The credential is temporary; storing it in the system keyring would create clutter.

There was not much abstraction which could be easily shared with SSH tunnels, so the code is separate, but adjacent.

Suggested followups

• Also bake in kubectl tunnels with kubectl port-forward.
• Also bake in gcloud ssh tunnels, or give an example for how to configure one with the existing SSH support.
• Guide boundary authentication if it has expired, or at least give a more specific error message.
• Resolve occasional SSL errors when making a boundary connection.

Checklist

• I added this contribution to the changelog.md file.
• I added my name to the AUTHORS file (or it's already there).
• To lint and format the code, I ran

  uv run ruff check && uv run ruff format && uv run mypy --install-types .