Add JWT Bearer authentication to Arrow Flight

[jakeichikawasalesforce]

Summary

Adds JWT Bearer authentication to TabPy's Arrow Flight (gRPC) path so
OAuth-configured clients can use Flight. Companion to #664, which covered
the HTTP path; Flight has its own middleware and without this change a
valid JWT is silently rejected on gRPC.

• New JwtAuthServerMiddlewareFactory reuses jwt_auth.validate_jwt
  (no duplicate validation). Failed Flight auth is UNAUTHENTICATED,
  not HTTP 401.
• When OAuth is enabled, the JWT factory is the only registered pyarrow
  middleware and delegates Basic if a password file is present. pyarrow
  runs every registered factory per call, so installing Basic as a
  sibling key would reject valid Bearer tokens.
• When OAuth is off, Basic Flight middleware is unchanged.
• OAuth-only + Arrow is now allowed at startup (previously rejected
  because Flight only had Basic middleware).
• Basic-issued opaque session tokens (returned via sending_headers)
  can be replayed as Bearer credentials. They expire after one hour and
  the store is capped at 1024 entries.
• JWKS client creation and fetches stay serialized, but a JWT check
  that cannot take the lock within one second fails closed instead of
  stalling the HTTP IO loop behind a Flight-triggered fetch.
• Conflicting Authorization values are rejected; repeating the same
  value is accepted.
• Docs updated in docs/server-config.md.

Testing

• Unit tests for the JWT Flight factory (test_jwt_server_middleware_factory.py):
  valid token, expired, wrong issuer, wrong audience, missing token,
  Basic delegation, opaque-token replay, malformed Basic credentials,
  and conflicting vs repeated Authorization headers.
• Unit tests for Basic-only Flight (test_basic_auth_server_middleware_factory.py):
  JWT-shaped Bearer rejected when OAuth is off, token expiry, bounded
  store, opaque replay without minting a second token.
• Config tests inverted so OAuth-only + Arrow starts successfully and
  asserts middleware wiring (issuer, JWKS URI, audience, scopes, Basic
  factory).
• JWKS lock-contention test: a caller blocked on an in-flight fetch
  fails fast instead of waiting out the fetch timeout.
• Full unit + Arrow integration suite: 214 passed locally