internal/transport: validate per-RPC credential metadata

[buger]

Fixes #9198

Validate metadata returned by transport-level and call-level PerRPCCredentials before appending it to HTTP/2 request headers. The validation happens after keys are lowercased, matching the existing outgoing metadata rules used for application metadata.

The regression tests cover invalid credential keys and values for both dial-level and call-level credentials.

RELEASE NOTES:

• credentials: Invalid metadata returned by per-RPC credentials is rejected before HTTP/2 request headers are created.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.27%. Comparing base (d74861e) to head (020a72f).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9202      +/-   ##
==========================================
+ Coverage   83.21%   83.27%   +0.06%     
==========================================
  Files         420      420              
  Lines       34008    34012       +4     
==========================================
+ Hits        28299    28324      +25     
+ Misses       4275     4258      -17     
+ Partials     1434     1430       -4     

Files with missing lines	Coverage Δ
internal/transport/http2_client.go	92.34% <100.00%> (-0.07%)	⬇️

... and 23 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.