[HOTFIX] Authenticate RemoteInterpreterEventServer callbacks

[jongyoul]

What

• Authenticate interpreter-to-server callback connections with per-interpreter-group credentials.
• Bind callback connections to the corresponding interpreter group, issue credentials before startup, restore them during recovery, and revoke them at shutdown.
• Propagate callback credentials through the supported launchers and restore them during interpreter recovery.
• Add regression coverage for callback transport, lifecycle, launchers, and recovery.

Why

RemoteInterpreterEventServer currently cannot reliably associate an incoming callback connection with the interpreter process and group that created it. This change gives each callback connection a verifiable group identity from interpreter startup through recovery and shutdown.

Draft status

This is intentionally a draft. Before it is ready for merge, it still needs:

• a rebase onto the latest master;
• a less observable credential-delivery path for Spark and Flink launchers;
• compatibility review of the selected SASL mechanism on hardened JVM configurations;
• another pass over recovery credential persistence and lifecycle complexity.

Validation

• Previously run focused callback, launcher, and recovery suites: 44 tests passed.
• Raw connections, mismatched credentials, cross-group calls, rotation, and recovery cases are covered.
• The broader SparkInterpreterLauncherTest run could not complete because generated interpreter/spark/scala-2.12 artifacts were not present in the worktree.
• git diff --check passes.