feat: use SecretStr for inference provider auth credentials (#3724)

# What does this PR do?

use SecretStr for OpenAIMixin providers

- RemoteInferenceProviderConfig now has auth_credential: SecretStr
- the default alias is api_key (most common name)
- some providers override to use api_token (RunPod, vLLM, Databricks)
- some providers exclude it (Ollama, TGI, Vertex AI)

addresses #3517 

## Test Plan

ci w/ new tests

llama_stack/providers/remote/inference/vllm/config.py

@@ -6,7 +6,7 @@
 
 from pathlib import Path
 
-from pydantic import Field, field_validator
+from pydantic import Field, SecretStr, field_validator
 
 from llama_stack.providers.utils.inference.model_registry import RemoteInferenceProviderConfig
 from llama_stack.schema_utils import json_schema_type
@@ -22,8 +22,9 @@ class VLLMInferenceAdapterConfig(RemoteInferenceProviderConfig):
         default=4096,
         description="Maximum number of tokens to generate.",
     )
-    api_token: str | None = Field(
-        default="fake",
+    auth_credential: SecretStr | None = Field(
+        default=None,
+        alias="api_token",
         description="The API token",
     )
     tls_verify: bool | str = Field(

llama_stack/providers/remote/inference/vllm/vllm.py

@@ -38,8 +38,10 @@ class VLLMInferenceAdapter(OpenAIMixin):
 
     provider_data_api_key_field: str = "vllm_api_token"
 
-    def get_api_key(self) -> str:
-        return self.config.api_token or ""
+    def get_api_key(self) -> str | None:
+        if self.config.auth_credential:
+            return self.config.auth_credential.get_secret_value()
+        return "NO KEY REQUIRED"
 
     def get_base_url(self) -> str:
         """Get the base URL from config."""