feat: use SecretStr for inference provider auth credentials (#3724)

# What does this PR do?

use SecretStr for OpenAIMixin providers

- RemoteInferenceProviderConfig now has auth_credential: SecretStr
- the default alias is api_key (most common name)
- some providers override to use api_token (RunPod, vLLM, Databricks)
- some providers exclude it (Ollama, TGI, Vertex AI)

addresses #3517 

## Test Plan

ci w/ new tests

tests/unit/providers/utils/inference/test_openai_mixin.py

@@ -720,7 +720,7 @@ class TestOpenAIMixinProviderDataApiKey:
     ):
         """Test that ValueError is raised when provider data exists but doesn't have required key"""
         with request_provider_data_context({"x-llamastack-provider-data": json.dumps({"wrong_key": "some-value"})}):
-            with pytest.raises(ValueError, match="API key is not set"):
+            with pytest.raises(ValueError, match="API key not provided"):
                 _ = mixin_with_provider_data_field_and_none_api_key.client
 
     def test_error_message_includes_correct_field_names(self, mixin_with_provider_data_field_and_none_api_key):