Add pluggable AuthHook trait and C4M token authentication

[suhasHere]

This PR is an implementation of #169. Adds intra-scope authorization to the relay via a pluggable AuthHook trait, with a C4M (CAT for MoQ) implementation using the cat-token crate.

New crates:

• moq-auth — AuthHook trait, AllowAll/KeyValue/Logging hooks, auth types
• moq-auth-cat — C4M hook: signature verification, claims validation, MOQT scope matching

Relay integration

• Parses AUTHORIZATION TOKEN from CLIENT_SETUP (USE_VALUE wire format)
• Calls on_setup at session establishment (fail-closed)
• Calls on_request before Publish/Subscribe/TrackStatus operations
• CLI: --auth-shared-secret (token type 0) and --auth-cat-public-key (C4M, requires --features auth-cat)

Test plan

Shared-secret (no extra features needed)

Start relay
cargo run --bin moq-relay-ietf -- --bind "[::]:4443" --tls-cert dev/localhost.crt --tls-key dev/localhost.key --auth-shared-secret "test-secret"

Publish (should succeed)
cargo run --bin moq-clock-ietf -- --publish --namespace "clock" --auth-token-type 0 --auth-token "test-secret" --tls-disable-verify https://localhost:4443

Publish with wrong secret (should be rejected)
cargo run --bin moq-clock-ietf -- --publish --namespace "clock" --auth-token-type 0 --auth-token "wrong" --tls-disable-verify https://localhost:4443

C4M token auth

Generate keys
openssl ecparam -genkey -name prime256v1 -noout | openssl pkcs8 -topk8 -nocrypt -out key.pem

openssl ec -in key.pem -pubout -out pub.pem

Install cat-token CLI
cargo install cat-token

Start relay with C4M
cargo run --bin moq-relay-ietf --features auth-cat -- --bind "[::]:4443" --tls-cert dev/localhost.crt --tls-key dev/localhost.key --auth-cat-public-key pub.pem --auth-cat-issuer my-issuer --auth-cat-audience my-relay

Generate publisher token
PUB_TOKEN=$(cat-cli moqt-token key.pem publisher "clock" --issuer my-issuer --audience my-relay --expires 3600)

Publish with token
cargo run --bin moq-clock-ietf -- --publish --namespace "clock" --auth-token "$PUB_TOKEN" --tls-disable-verify https://localhost:4443

Subscribe (generate subscriber token first)

SUB_TOKEN=$(cat-cli moqt-token key.pem subscriber "clock" --issuer my-issuer --audience my-relay --expires 3600)

Subscribe with token

cargo run --bin moq-clock-ietf -- --namespace "clock" --auth-token "$SUB_TOKEN" --tls-disable-verify https://localhost:4443

[thibmeu]

very brief comment as I'm building off this PR: this is USE_ALIAS, not USE_VALUE which is 0x3, both in -16 and -18 https://datatracker.ietf.org/doc/html/draft-ietf-moq-transport-16#section-13.1