feat(secret): Add proto-driven ProjectionProvider provider for secret key mapping.

Adds ProjectionProvider, a new Provider implementation that resolves secret paths by reading field values from a protobuf message rather than hardcoding key names. NewProjectionProvider wraps an underlying Provider with a proto.Message whose string fields map logical credential names (e.g. "username", "password") to the actual key names stored in the Secret.

Get looks up the requested name against the message descriptor by text name, rejects non-string fields with ErrProjectionInvalid, and returns ErrProjectionMissing when an optional field is absent — distinguishing internal logic errors from user configuration errors so callers can surface the right message.

Adds TestProjection covering successful lookups against PostgreSQLProjection and the missing-field path, and TestProjection_internalErrors covering a non-string field (port) and a field name that does not exist in the descriptor.