[EPIC] Add provider-neutral KMS interfaces

[nevzheng]

Describe the proposal

Add server-private, provider-neutral KMS interfaces and named-source routing to Apache Gravitino.

This epic includes:

• typed references that identify a configured KMS source and provider-native key;
• stable JSON persistence for key references and canonical provider API values;
• normalized key properties and capabilities;
• provider-facing client and factory contracts;
• named-source configuration, discovery, routing, and lifecycle management; and
• reusable fake implementations and contract tests.

KMS credentials and key material remain server-private. Concrete provider implementations, provider integration tests, provider documentation, and distribution packaging are outside this epic.

Task list

• #12132 Define provider-neutral KMS contracts and canonical key-reference JSON
• #12133 Add named-source configuration, routing, and lifecycle management