refactor(protocol): add certificate authentication provider

[Jason-Morcos]

Summary

• add an immutable CertificateAuth provider with file and in-memory factories, a credential-free representation, and no public or dataclass credential fields
• let DtlsCoapSession accept auth= and delegate the existing CA, verification callback, cipher, and credential-loading sequence to the provider
• retain cert_path / key_path and cert_pem / key_pem as a compatibility adapter, with the existing validation and public attributes and no deprecation warning
• document the provider API and its compatibility rules

Compatibility boundary

This is the pure no-behavior-change CertificateAuth slice agreed in #28, rebased after #23-#25 landed. Existing file and memory constructor paths now create the provider internally; supplying both auth and legacy credential arguments fails immediately.

This PR does not add PSK authentication, Samsung-specific server profiles or identity enforcement, lifecycle changes, probe behavior, or new cipher choices.

Validation

• python -m pytest -q on Python 3.14: 130 passed
• dependency-floor suite with cbor2 5.6.0, pyOpenSSL 23.1.0, and pytest 8.0.0: 130 passed
• current LocalThings consumer suite against this branch: 1,070 passed
• targeted Ruff checks, compileall, share-safety scan, distribution-content check, and isolated wheel/sdist imports passed

Part of #28.