Enable workload identity for event stream

[mismithhisler]

Description

Enables Workload Identities to subscribe to event streams. Previously, the event broker used custom authentication logic that could only accept the secretID from an ACL Token. This change refactors the event broker to use an authentication callback for handling authentication while subscribing and after various ACL events. This allows us to inject the standardized Authenticator logic into the event broker.

Testing & Reproduction steps

Enable ACL's, create the appropriate policy, associate it with a workload, and use the WI as the Bearer token when subscribing to the events stream.

Links

Fixes GH #18186

Contributor Checklist

• Changelog Entry If this PR changes user-facing behavior, please generate and add a
  changelog entry using the make cl command.
• Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
  ensure regressions will be caught.
• Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
  and job configuration, please update the Nomad website documentation to reflect this. Refer to
  the website README for docs guidelines. Please also consider whether the
  change requires notes within the upgrade guide.

Reviewer Checklist

• Backport Labels Please add the correct backport labels as described by the internal
  backporting document.
• Commit Type Ensure the correct merge method is selected which should be "squash and merge"
  in the majority of situations. The main exceptions are long-lived feature branches or merges where
  history should be preserved.
• Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
  within the public repository.

[jrasell]

LGTM, thanks @mismithhisler!

I think the PR still needs a changelog entry and I added a couple of inline queries, so I'll comment as my approval will likely get removed with at least the changelog commit.