[Feature]: Zendesk piece — add OAuth2 auth alongside API token (Zendesk deprecating tokens)

Problem

Zendesk is retiring API tokens. The piece supports only them.

Current auth: PieceAuth.CustomAuth (agent email + API token + subdomain), Basic email/token:token header — packages/pieces/community/zendesk/src/index.ts.

Zendesk timeline (https://developer.zendesk.com/documentation/authentication/oauth-migration/#migration-timeline):

• Jul 28, 2026 — tokens idle 30 days auto-deactivated (deleted after 60). Zendesk accounts created on or after this date cannot create or use API tokens at all, so new customers can no longer connect the piece.
• Oct 27, 2026 — existing accounts can no longer create new tokens via UI or API.
• Apr 30, 2027 — all remaining tokens permanently deactivated, requests using them fail.

Affects Ticketing, Help Center and Voice APIs.

Ref: Pylon 6010

Proposed

Add OAuth2 as a second auth method. Keep CustomAuth until Apr 30, 2027.

• Multi-auth is already plumbed: createPiece accepts PieceAuthProperty[] (packages/pieces/framework/src/lib/piece.ts) and the connection dialog renders an auth picker (packages/web/src/app/connections/create-edit-connection-dialog.tsx). No framework work.
• authUrl/tokenUrl support {prop} interpolation (precedent: salesforce https://{environment}/services/oauth2/authorize), so https://{subdomain}.zendesk.com/oauth/authorizations/new with a subdomain OAuth prop.
• Blocking prerequisite: Zendesk OAuth clients are scoped to one Zendesk instance. A global OAuth client must be requested from Zendesk (marketplace process) so cloud users don't each register their own.
• 17 actions, 10 triggers and the custom API call each build the Basic header inline. Each needs to branch on auth type and send Bearer for OAuth2.
• Scopes needed: read + write (tickets, users, organizations) — confirm against the action set.

Out of scope

Removing API token auth. It stays until Apr 30, 2027.