feat(redis): wire secret projection through Redis client

Summary

Mirror the PostgreSQL secret-projection pattern (v2/postgres/client.go) on the Redis client. The client now reads SecretRef.Format and SecretRef.Projection from the infrastructure proto introduced in gitlab-com/gl-infra/platform/runway/fairway!96 (merged) and resolves each credential at the projection-mapped key under the redis/ secret prefix.

This is a follow-up of the merged MR feat(infrastructure): Add config option for Redis MR (!511 (merged)).

What changed

• New errors: ErrUnknownSecretFormat, ErrSecretProjectionMissing (matching the postgres package).
• New projectionPresets map. REDIS_FORMAT_VALKEY projects only password → "default-password", matching the valkey/valkey Helm chart's <release>-auth Secret per the bundled-chart migration guide. Username and Sentinel credentials are intentionally absent since Valkey does not project them.
• New interface to separate the auth configuration behaviour.
• REDIS_FORMAT_UNSPECIFIED is treated as unauthenticated.
• resolveAuthConfig rewritten to drive secret reads from the projection:
  • Unset projection field ⇒ skip the secret entirely. For Password / SentinelPassword this is the way to express an unauthenticated connection.
  • Username / SentinelUsername: missing secrets are tolerated (left empty), preserving the previous lenient behaviour for optional fields.
  • Password / SentinelPassword: missing secrets return a wrapped error. This matches the postgres package's stricter posture and prevents silently constructing an unauthenticated client when the operator asked for authentication.
• Redis docs are updates to highlight the change.

To Do

• Bump the version of Fairway once fairway!96 is merged.
• Bump the version of Fairway once gitlab-com/gl-infra/platform/runway/fairway!107 (merged) is merged.

Links to relevant issues

Issue: gitlab-com/gl-infra/platform/runway/team#874 (closed)