chore: promote auth package from http.auth to top-level auth

[OmarAlJarrah]

What

Moves the authentication package up one level, from org.dexpace.sdk.core.http.auth to org.dexpace.sdk.core.auth. No subpackaging; the auth types stay in one flat package.

Why

The http.* subpackages (request, response, common, context, sse, paging) are HTTP wire models and call mechanics. Authentication is a different kind of thing: a cross-cutting capability covering credentials, token providers, RFC 7235 challenge handling, and the per-operation auth descriptor ladder. It sits more naturally alongside the other top-level capability packages (pipeline, pagination, serde, instrumentation) than under the HTTP models.

The dependency structure backs this up:

• The auth package has no compile dependency on the HTTP models beyond Method and HttpHeaderName. It does not reference Request, Response, or Headers.
• The auth-to-HTTP wiring already lives outside the package, in http.pipeline.steps (the *AuthStep classes).

So http.auth was nested under http by topic, not by coupling. The new location reflects how the code is actually wired.

Scope

• Moved 19 main and 16 test sources to the new package (history preserved via rename).
• Updated every importer: 5 in sdk-core (ContextStore KDoc links, the three *AuthStep steps, ProxyOptions), the Java test helper, the relevant pipeline-step and proxy tests, plus sdk-example and both transport test suites.
• Regenerated the sdk-core .api snapshot.
• Updated package references in README.md, CLAUDE.md, and docs/ (architecture, implementation-plan, refs-comparison).

Breaking change

The fully-qualified name of every auth type changes (…http.auth.X becomes …auth.X). Callers update their imports accordingly. The .api snapshot is regenerated to match, so apiCheck passes.

Not changed

The http.auth.* instrumentation event names (such as http.auth.background_refresh_failed) are left as-is. They namespace the HTTP call domain for observability and follow the existing http.* event convention (compare http.instrumentation.*), independent of the code package layout.

Verification

./gradlew build passes locally (tests, ktlint, detekt, apiCheck, kover), minus the network-gated :sdk-shrink-test:r8Run step, which CI runs.