feat: use SecretStr for inference provider auth credentials (#3724)

# What does this PR do?

use SecretStr for OpenAIMixin providers

- RemoteInferenceProviderConfig now has auth_credential: SecretStr
- the default alias is api_key (most common name)
- some providers override to use api_token (RunPod, vLLM, Databricks)
- some providers exclude it (Ollama, TGI, Vertex AI)

addresses #3517 

## Test Plan

ci w/ new tests

llama_stack/providers/remote/inference/databricks/config.py

@@ -18,8 +18,9 @@ class DatabricksImplConfig(RemoteInferenceProviderConfig):
         default=None,
         description="The URL for the Databricks model serving endpoint",
     )
-    api_token: SecretStr = Field(
-        default=SecretStr(None),  # type: ignore[arg-type]
+    auth_credential: SecretStr | None = Field(
+        default=None,
+        alias="api_token",
         description="The Databricks API token",
     )
 

llama_stack/providers/remote/inference/databricks/databricks.py

@@ -27,9 +27,6 @@ class DatabricksInferenceAdapter(OpenAIMixin):
         "databricks-bge-large-en": {"embedding_dimension": 1024, "context_length": 512},
     }
 
-    def get_api_key(self) -> str:
-        return self.config.api_token.get_secret_value()
-
     def get_base_url(self) -> str:
         return f"{self.config.url}/serving-endpoints"