Postgres: support SASL OAUTHBEARER (PostgreSQL 18 `oauth` authentication method)

Problem

PostgreSQL 18 added the oauth HBA method, which authenticates a connection with an OAuth 2.0 bearer token over SASL OAUTHBEARER (RFC 7628) instead of a password.

sqlx-postgres supports only SCRAM-SHA-256 and SCRAM-SHA-256-PLUS — the mechanism match in connection/sasl.rs rejects anything else — so a server with an oauth HBA line cannot be connected to at all. Managed Postgres offerings are starting to expose this method, and it is the only one available on some of them.

There is no workaround out of tree: mod connection and mod message are private, PgConnection::establish is pub(crate), every PgConnectOptions field is pub(crate), and the socket is created internally. So this has to be an in-tree change.

Proposed scope: token-first only

The caller supplies a token; the driver performs the SASL exchange. SQLx would not talk to an identity provider — no discovery, no device authorization flow, no token refresh logic. That is the same line node-postgres and pgx draw, and it keeps the whole feature to the SASL exchange plus one option.

Token-first is also a single round trip: PostgreSQL accepts auth=Bearer <token> directly in the SASL initial client response, so nothing needs a prior challenge.

Proposed surface

Because tokens expire, a per-attempt callback is more useful than a stored string — a pool reconnecting hours later needs a fresh token. pgx ships exactly this shape (OAuthTokenProvider func(context.Context) (string, error)):

let options = PgConnectOptions::new().oauth_token_provider(|| async {
    Ok(refresh_my_token().await?)
});

// or, for a token that outlives the connections made with it
let options = PgConnectOptions::new().oauth_token(token);

I tasked my clanker with a PR