Validate credential whitespace before storing

[RitwijParmar]

Summary

• reject credentials with newlines, tabs, control chars, or surrounding whitespace before they reach OkHttp Authorization headers
• apply the validation in CLI credentials set, REST create/update, and startup env seeding
• add regression coverage for CLI validation, REST validation, and env import skipping

Fixes #260

Verification

• Blocked locally: ./gradlew test --tests dev.agentspan.runtime.controller.CredentialControllerTest --tests dev.agentspan.runtime.credentials.CredentialEnvSeederTest could not run because this shell has no Java runtime installed.
• Blocked locally: go test ./cmd -run 'TestCredentials(Set|List|Delete|Bind|Bindings|Bearer|NoAuth)' could not run because go is not installed on PATH.