Kafka gateway: Kafka SASL authentication bridge to Iggy users

[ryerraguntla]

Part of #3560.

Summary

Map Kafka SaslHandshake (17) and SaslAuthenticate (36) to Iggy authentication.

Open question (from discussion #3253)

• One-to-one SASL user → Iggy user mapping?
• Or shared kafka-bridge service account?

Depends on

• Kafka gateway: Kafka gateway Phase 1 — docker-compose, E2E tests, and quick-start docs #3539 — Phase 1

Scope

• Document chosen auth model in ADR
• PLAIN / SCRAM (prioritize what Iggy supports)
• Map authenticated identity to Iggy SDK login
• ACL mapping to Iggy permissions (may split follow-up)

Acceptance criteria

• Kafka client with SASL can produce/consume through gateway
• Unauthorized credentials rejected with Kafka error codes

References

• Rollout plan: feature - Order of Implementation discussion of kafka to iggy bridge #3253 (comment)