Phase AUTH-5: missing SASL mechs — EXTERNAL, CRAM-MD5, GSSAPI

[0kaba0hub]

Currently shipped

PLAIN, OAUTHBEARER, XOAUTH2, SCRAM-SHA-256 (+PLUS), SCRAM-SHA-1 (+PLUS).

Still missing (by demand order)

1. EXTERNAL — certificate-based auth
2. CRAM-MD5 — 0kaba0hub/go-sasl fork (yarilo-patches) already has server-side impl; pick up from there
3. GSSAPI — Kerberos; lowest priority

Each mechanism ships as its own PR with a mechanisms: [...] config knob.

Reference

See docs/AUTH_REVIEW.md §Phase AUTH-5.