Add OAuth2 client credentials grant support

[murthy-chelankuri]

Summary

• Recreates the feature proposed in support for prometheus oauth2.0 client credential grafana#119576, which the maintainer closed after the Prometheus datasource was extracted into this repo, asking for it to be resubmitted here instead.
• Adds a new "OAuth2 Client Credentials" auth method to the datasource config editor (Client ID, Client Secret, Token URL, Scopes), alongside the existing Basic Auth / Forward OAuth Identity / Cross-site credentials options.
• Adds a backend middleware (pkg/promlib/middleware/oauth2_client_credentials.go) that exchanges those credentials for a bearer token via golang.org/x/oauth2/clientcredentials and attaches it to outgoing Prometheus requests, with automatic caching/refresh.

Test plan

• go build/go vet/go test ./... pass in both the root module and the pkg/promlib module, including new middleware and settings-validation tests
• npm run typecheck and npm run lint clean
• npm run test:ci — full suite (1080 tests) passes, including new config-editor tests
• mage -v backend build and npm run build frontend build both succeed
• /validate-plugin packaging check — no new errors/warnings introduced
• Manual end-to-end verification against a real Grafana + Prometheus (this repo's docker compose dev stack) and a mock OAuth2 client-credentials token endpoint:
  • Correct credentials → datasource health check succeeds, token request observed with grant_type=client_credentials
  • Wrong client secret → health check fails closed with oauth2: "invalid_client", proving the request is genuinely gated on a valid token

[github-actions]

Signed commits report

3 of 3 commits between main and oauth2-client-credentials could not be fully verified:

Commit	Author	Reason	Message
81831f65	Murthy Chelankuri	unsigned	Add OAuth2 client credentials grant support
d7bb7a66	Murthy Chelankuri	unsigned	fix(oauth2): refresh client-credentials token on 401, not just local expiry
a64a2979	Murthy Chelankuri	unsigned	fix(auth): move "No Authentication" to the end of the auth method dropdown

This repository requires all commits to be signed. See GitHub docs on commit signature verification.

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}