feat: use SecretStr for inference provider auth credentials (#3724)

# What does this PR do?

use SecretStr for OpenAIMixin providers

- RemoteInferenceProviderConfig now has auth_credential: SecretStr
- the default alias is api_key (most common name)
- some providers override to use api_token (RunPod, vLLM, Databricks)
- some providers exclude it (Ollama, TGI, Vertex AI)

addresses #3517 

## Test Plan

ci w/ new tests

llama_stack/providers/remote/inference/groq/config.py

@@ -21,12 +21,6 @@ class GroqProviderDataValidator(BaseModel):
 
 @json_schema_type
 class GroqConfig(RemoteInferenceProviderConfig):
-    api_key: str | None = Field(
-        # The Groq client library loads the GROQ_API_KEY environment variable by default
-        default=None,
-        description="The Groq API key",
-    )
-
     url: str = Field(
         default="https://api.groq.com",
         description="The URL for the Groq AI server",