feat: implement a specialized `TokenSource` interface

Changes:

* Introduce a new `TokenSource` interface for generating
  authentication headers.
* Implement three variants of the interface:
  1. `staticTokenSource` to wrap a personal, project, or group access token, or
     a job token.
  2. `OAuthTokenSource` to wrap an `oauth2.TokenSource`.
  3. `passwordCredentialsTokenSource` to encapsulate the resource owner
     password credentials flow.
* Update all `New*Client` calls to create an appropriate `TokenSource` and pass
  it to `newClient`.
* Introduce a new `NewTokenClient` constructor that accepts a `TokenSource`
  directly.
* Add unit tests for constructor functions that ensure correct authentication
  to the backend.