[Feature Request]: OAuth 2.0 Client Credentials authentication for the REST API data source connector

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (Language Policy).
• Non-english title submitions will be closed directly ( 非英文标题的提交将会被直接关闭 ) (Language Policy).
• Please do not modify this template :) and fill in all the required fields.

Is your feature request related to a problem?

The generic REST API data source connector (`common/data_source/rest_api_connector.py`) only supports four auth types: `none`, `api_key_header`, `bearer` and `basic`.

Many SaaS APIs (e.g. Mayday) only support the OAuth 2.0 Client Credentials grant: a `client_id` / `client_secret` pair is exchanged at a token endpoint for a short-lived access token (JWT).

With the current `bearer` option, the token must be pasted in manually and is never refreshed. Once it expires, every scheduled sync fails with an authentication error. A local proxy that handles the OAuth flow isn't an option either, because the connector's SSRF protection (correctly) blocks localhost and private addresses.

Describe the feature you'd like

Add a new auth type, oauth2_client_credentials, with these settings:

• token_url (required)
• client_id and client_secret (required, stored as credentials)
• scope (optional)
• extra token request params, e.g. audience (optional)
• client authentication method: credentials in the POST body or via HTTP Basic (default: body)

Expected behaviour:

1. Before the first request, POST grant_type=client_credentials to token_url and read access_token and expires_in.
2. Send Authorization: Bearer <access_token> on API requests.
3. Cache the token and fetch a new one shortly before it expires.
4. On a 401 response, fetch a new token and retry the request once before failing.
5. Apply the same SSRF validation to token_url as to the API URL.

Describe implementation you've considered

No response

Documentation, adoption, use case

Additional information

No response