Unify external resource group credentials across core, client, and gRPC

[coderabbitai]

Summary

Define external resource group credentials as a shared public contract.

Required changes

• Move ExternalResourceGroupCredentials from components/spider-storage/src/db/protocol.rs to the core crate.
• Update the public spider-client API to accept and use this shared credentials type.
• Define the credentials as a single message in the gRPC protocol, instead of separate external resource group ID and password fields.
• Update storage, gRPC, and client call sites to use the shared contract.

Rationale

The public client API and the gRPC protocol should use one credential type. This reduces duplicated credential fields and keeps the public API aligned with the internal storage contract.

Affected areas

• Core types
• spider-client public API
• gRPC protocol definitions and generated bindings
• Storage service credential handling

Acceptance criteria

• The shared credentials type is defined in the core crate.
• The public spider-client API accepts the shared credentials type.
• The gRPC protocol transports credentials as one message.
• Storage and gRPC call sites compile against the shared contract.
• Tests cover credential serialization and public client registration with resource group credentials.

Backlinks

• Source PR: feat(spider-storage)!: Add resource group verification in execution manager registration. #464
• Source comment: feat(spider-storage)!: Add resource group verification in execution manager registration. #464 (comment)
• Requested by: @kirkrodrigues