GRPC-tunnel: fix non-bearer auth credential schemes

[shawnburke]

Stack 1/3 — base main. Independent of the other two; reviewable and mergeable on its own.

The bug

Three of the four auth schemes sent the wrong credential:

scheme	sent	should send
token	Bearer <t>	Token <t>
raw	raw <t>	<t> — no prefix
basic with a pre-encoded token	Basic Og== (base64 of ":", an empty credential)	the token verbatim

The basic case is the sharp one: a rule carrying an already-encoded user:pass pair — the shape Azure Repos uses — dropped it and authenticated as nobody.

The fix

A scheme is supported exactly when authHeaderBuilders has a builder for it, so the supported set and the behaviour cannot drift. They were previously a set in one file and a switch in another, raw string literals in both — a scheme in the set with no case sends no credential while claiming support, and a case with no set entry warns about itself while working fine.

The builder bodies match snyk-broker's lib/common/utils/auth-header.ts.

An unrecognized scheme now warns and sends no header, which is what the broker's authHeader() does with one — it returns undefined. Previously it invented <scheme> <token>.

Scope

auth.go is new; applyAuth moves out of router.go whole. Nothing else in router.go is touched, and no signature changes — this is why it sits at the bottom of the stack rather than tangled into the wildcard work.

Test plan

• router_auth_test.go covers each scheme's exact header, case-insensitive scheme lookup, basic preferring username/password when both are present, and an unknown scheme sending nothing.
• TestEveryDeclaredAuthSchemeBuildsACredential iterates authHeaderBuilders, so a scheme added without a test fails the build rather than shipping untested.
• test/conformance/auth_schemes.json encodes the same cases as transport-agnostic fixtures.
• go test ./server/snykbroker/... ./common/... green.

🤖 Generated with Claude Code