feat(artifact-registry): add glab artifact-registry status

Adds glab artifact-registry status, the first of six steps splitting !3662 (closed) into one command per merge request. The full breakdown is in artifact-registry#222.

status exchanges a GitLab credential for a short-lived Artifact Registry access token and prints the token's issuer, subject, and expiry, so you can confirm which identity and instance you are authenticated as. Nothing is written to disk. ar is kept as an alias, so glab ar status works.

This step also ships internal/api/artifactregistry, the client for POST /api/v4/token_exchange. It ships alongside its first caller on purpose: a client with no consumer is dead code, and its API cannot be judged without seeing a caller.

No existing command changes behavior.

Notes for reviewers

• The command is labeled EXPERIMENTAL in --help and in docs/source/artifact-registry/status.md, via text.ExperimentalString.
• Token claims are decoded unverified (ParseUnverified). The trust boundary is the TLS connection to the GitLab host that issued the token, not the token's signature.
• The exchange asks for MinDuration (15m), the shortest lifetime the server accepts, because the token is read for its claims and then discarded. Minting a token is still server-side state, which is why the command is annotated mcpannotations.Destructive rather than Safe.
• Tests drive an httptest server rather than gitlabtesting.NewTestClient. token_exchange is not part of client-go's service surface: the client calls it through gl.NewRequest and gl.Do, so there is no generated mock.
• The audience value gitlab-artifact-registry is not a URI, which is awkward for services that will verify these tokens later. The server decides which audiences it accepts, so this cannot change client-side alone. Tracked in artifact-registry#222.