This commit formats our source code using gofmt.

Because we create MRs to the fields package from labkit-spec and the
generated MRs do not conform to gofmt formatting - I've elected to
exclude the fields packages from this formatting pass, to avoid
obfuscating future diffs.

For the same reason, I've elected to not set up automated formatting in
CI / lefthook until this can be given some dedicated thought.

Ran:
`gofmt -w **/*.go; git restore v2/field*/`

Replaces the inline secret-resolution logic in `projectionFormat` with the
generic `secret.ProjectionProvider` and `secret.PrefixProvider` types
introduced earlier. `newProjectionFormat` now resolves the
`PostgreSQLProjection` upfront (returning an error immediately on invalid
config) and stores a pre-built `secret.Provider` chain —
`PrefixProvider("postgresql/", ...)` wrapping a `ProjectionProvider` — on the
struct. `resolveSecret` and `resolveConfigKey` are simplified to delegate
directly to that provider, removing the inline path-assembly, the
`strings.Contains` path-traversal guard (now redundant since
`ProjectionProvider` resolves the key name from the proto descriptor), and the
`secretRef *string` parameter from `resolveConfigKey`.

Changes `newPSQLFormat` to return `(psqlFormat, error)` so that `projection()`
failures (unknown format, missing CUSTOM projection) are surfaced before `DSN`
is called. `client.go` and `client_test.go` are updated accordingly. The
`hostArgs` and `portArgs` struct fields are renamed from `*Conf`/`*Proj` to
`*Config`/`*Secret` for clarity.

Replaces the package-local `ErrSecretProjectionMissing` sentinel with
`secret.ErrProjectionMissing` from the shared `secret` package.

`secret.ErrProjectionMissing` errors are swallowed
in `v2/objectstore/binding.go`'s `unsetToEmpty`

The `--fix` flag was passed to every lint run, causing golangci-lint to
exit 0, even when it rewrote files. This silently swallows lint
failures at CI time.

This commit removes the `--fix` flag and adds the ability to forward
arbitrary flags to the script / mise task.

golangci-lint error:
  objectstore/binding.go:20:59: QF1008: could remove embedded field "Config" from selector (staticcheck)
	  if infraCfg == nil || infraCfg.Config == nil || infraCfg.Config.GetObjectStore() == nil {
	                                                         ^
  objectstore/binding.go:32:18: QF1008: could remove embedded field "Config" from selector (staticcheck)
		os  = infraCfg.Config.GetObjectStore()

Replaces the single `wantErr` field with `wantNewErr` and `wantDSNErr` so each
case asserts the error against the specific stage that produces it, rather than
matching the same expected error against both `newPSQLFormat` and `DSN`.  Cases
are updated to set whichever field applies.

Switches the assertions to `require.ErrorIs`, dropping the manual `errors.Is`
checks and the now-unused `errors` import. Marks the test parallel with
`t.Parallel()`.

Introduces named constants for the `PostgreSQLProjection` JSON field names
(`fieldHost`, `fieldPort`, and so on) and uses them throughout `DSN`,
`resolveHost`, and `resolvePort` in place of scattered string literals, so the
field names live in one place.

Replaces the `hostArgs` and `portArgs` structs with plain parameters on
`resolveHost` and `resolvePort`, passing the pool and non-pool config values
directly. The secret-field arguments are no longer threaded through the callers
since each helper now references the field constants itself.

Simplifies the projection lookup in `newProjectionFormat` to use
`o.infra.GetPostgresql()` instead of `o.infra.Config.GetPostgresql()`.

Builds the secret resolution chain in `newAuthnFormat` by wrapping
`infra.Secrets` in a `PrefixProvider` (mapping lookups under `redis/`) and a
`ProjectionProvider`, stored on `authenticatedFormat` as a `secret.Provider`.
`resolveSecret` now delegates to this provider keyed by JSON field name, and
the per-field nil-projection plumbing in `AuthConfig` and `Addrs` is replaced
by `resolveConfigKey`/`resolveSecret` calls against the new field-name
constants (`fieldAddrs`, `fieldUsername`, and so on). `resolveConfigKey` lets
an explicit value in the Redis config take precedence over the projected
secret.

Moves validation up front: `newAuthnFormat` now resolves the projection and
rejects a nil secret provider with `ErrMissingSecrets` at construction time,
and wraps the nil-infra case with `infrastructure.ErrNotConfigured`. The
`projection` method becomes a package function taking the config directly,
since resolution no longer hangs off `authenticatedFormat`.

Adds `ignoreProjectionMissing` to strip `secret.ErrProjectionMissing` from the
joined error, so optional projection fields that are unset no longer fail
`AuthConfig`. The method now returns a zeroed `authConfig` on any remaining
error rather than a partially populated one.

Updates the tests to construct formats via `newAuthnFormat`, assert error
sentinels with `errors.Is` and types with `reflect.Type`, and compare configs
with `cmp.Diff`, adding `github.com/google/go-cmp`. Constructor-time failure
cases (nil secrets, unknown format, missing projection) move to
`Test_newAuthnFormat`, and a case covering config-over-secret precedence is
added.

Drops the redundant `cfg.GetUsername()` and `cfg.GetSentinelUsername()` seeding
in `AuthConfig`, since `resolveConfigKey` already applies the config value with
precedence, and declares `auth` and `errs` together.

Rewrites `ignoreProjectionMissing` as an explicit loop that joins the
non-`ErrProjectionMissing` errors, replacing the in-place `slices.DeleteFunc`
and dropping the `slices` import.

Lowercases the `secrets.Get` error string prefix to follow Go's convention that
error strings are not capitalized.

Make golangci-lint --fix opt-in to avoid swallowing errors in CI

See merge request !559

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

chore(v2/objectstore): remove misnomer objectstore.New() comment

See merge request !558

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

refactor(postgres): Wire `projectionFormat` through `ProjectionProvider` and `PrefixProvider`.

See merge request !555

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: Florian Forster <fforster@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Florian Forster <fforster@gitlab.com>

refactor(redis): Migrate to `ProjectionProvider` and `PrefixProvider`.

See merge request !560

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: Florian Forster <fforster@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Florian Forster <fforster@gitlab.com>

Named paramaters are standard here.

More efficient, but primarily adjusted to silences gopls' diagnostic warning.

Enables the function to be shared by both formats, removing
noSecretFormat's duplicated nil-checks.

The .go-build-cache job pointed GOMODCACHE/GOCACHE at paths outside
$CI_PROJECT_DIR, which the runner silently skips, so every Go job ran cold.
Relocate both caches into $CI_PROJECT_DIR and split them:

- Modules: one shared, read-only cache seeded by a warm-go-mod-cache job
  (new prepare stage) so consumers can't overwrite the complete set with a
  partial one. golangci_lint depends on it to wait out the prepare stage.
- Compiled objects: per-job cache keyed on $CI_JOB_NAME_SLUG, since output is
  specific to build tags, Go version, and -race.

Post review follow-ups for fforster/redis

See merge request !557

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Florian Forster <fforster@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

fix(ci): make .go-build-cache actually cache Go artifacts

See merge request !562

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

chore(v2): gofmt format non-fields packages

See merge request !552

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

chore(mise): add compile task

See merge request !547

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

fix(deps): update module gitlab.com/gitlab-com/gl-infra/platform/runway/fairway to v1.32.1

See merge request !561

Merged-by: João Pereira <jpereira@gitlab.com>
Approved-by: Sahand Abbasi <sabbasi@gitlab.com>
Approved-by: João Pereira <jpereira@gitlab.com>
Co-authored-by: GitLab Renovate Bot <ops-contact+gl-common-ci-tasks-self-renovate@gitlab.com>