Route JWT private-key client-assertion auth (RFC 7523) through the kernel
backend. When the caller passes `oauth_jwt_key_file` (+ `oauth_client_id`
and `oauth_jwt_kid`, optional `oauth_jwt_passphrase` / `oauth_jwt_algorithm`
/ `oauth_scopes` / `token_url`), the bridge forwards them to the kernel's
`auth_type="oauth-m2m-jwt"`, which signs a short-lived assertion with the
private key instead of sending a client secret and owns the token lifecycle.

- auth_bridge.py: new JWT branch (checked before shared-secret M2M and PAT,
  since a private-key file is unambiguous JWT M2M intent); mutually exclusive
  with oauth_client_secret / credentials_provider; requires client_id + kid.
- session.py: forward the new oauth_jwt_* / token_url kwargs into the kernel
  auth options.
- tests: 9 unit tests covering routing, precedence, validation, and
  ambiguity guards.

Verified end-to-end: `SELECT 1` via use_kernel=True against an Azure
Databricks warehouse, authenticated by Entra ID against the service
principal's registered public certificate.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

The JWT branch introduced an earlier untyped `kwargs =`, so mypy flagged
the M2M branch's `kwargs: Dict[str, Any]` as a redefinition. Move the
annotation to the first (JWT) assignment.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

…ments

Address peco-review-bot review on #921:
- Medium: add the missing ambiguity guard for oauth_jwt_key_file +
  auth_type="databricks-oauth" (U2M intent), mirroring the existing
  shared-secret M2M + U2M guard. Fails loudly rather than silently
  resolving to one flow. Covered by a new unit test.
- Low: renumber the inline resolution-order comments (PAT→3, U2M→4,
  creds→5, else→6) to match the docstring after the JWT branch insert.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

Address Eric's review on #921: add rows for oauth_jwt_key_file /
oauth_jwt_kid / oauth_jwt_passphrase / oauth_jwt_algorithm / token_url
to the connection-parameter reference (all kernel-only).

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

…ner)

Security Scan flagged cryptography@49.0.0 CVE-2026-69247
(GHSA-g6cj-pr64-35w5 / PYSEC-2026-3552, CVSS 8.2) — a Bleichenbacher-style
oracle in PKCS#7 EnvelopedData / S-MIME decryption. `cryptography` is a
transitive dep (PyJWT[crypto] / oauthlib) used only for OAuth token
signing/verification; the connector never decrypts PKCS#7 / S-MIME, so the
vulnerable path is never invoked. Pre-existing on main (transitive, not
introduced by this PR). Suppress both OSV ids with justification; a clean
bump awaits PyJWT/oauthlib floors pulling cryptography>=50.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

Address peco-review-bot: the CONNECTION_PARAMETERS.md row said token_url
"applies to shared-secret M2M too", but the bridge only forwarded it on
the JWT branch — so an oauth_client_id + oauth_client_secret + token_url
connection silently dropped token_url.

token_url is an auth-method-agnostic token-endpoint override: JDBC's
OAuth2ConnAuthTokenEndpoint is consumed by the client-secret M2M provider,
the JWT provider, and the refresh provider alike; the Node driver also
forwards it on both branches; and the kernel's oauth-m2m auth_type accepts
it (pyo3). Forward it on the shared-secret M2M branch so code matches the
doc and the other drivers. Adds a unit test.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>