RFC for vMCP upstream_inject outgoing auth strategy

[tgrunnagle]

Related issue: https://github.com/stacklok/stacklok-epics/issues/251

Summary

RFC-0053 (embedded AS in vMCP) wired upstream token accumulation into the vMCP auth pipeline and populated identity.UpstreamTokens at middleware time — but deliberately deferred the outgoing strategy that consumes those tokens. This PR adds that strategy.

• Adds an RFC that specifies the upstream_inject outgoing auth strategy, which reads a named provider's access token from identity.UpstreamTokens map[string]string and injects it as Authorization: Bearer on outgoing backend requests.
• The strategy is stateless and reads from identity.UpstreamTokens directly (no UpstreamTokenSource interface), consistent with RFC-0052's eager-load pattern.
• Specifies an optional subjectProviderName enhancement to token_exchange for cases where the backend STS trusts an upstream IDP rather than the TH-AS issuer.
• Covers CRD changes: ExternalAuthTypeUpstreamInject, UpstreamInjectSpec, UpstreamInjectConverter, and subjectProviderName on the existing TokenExchangeConfig CRD type.

[jhrozek]

LGTM, I'd just wait for Jeremy to see if the identity passing was as he wanted (I know he had opinions but I forgot what they were)