feat(core): add Snowflake Cortex browser OAuth - #47135

Port Snowflake Cortex browser OAuth from V1 to the V2 plugin system.

• Registers a browser OAuth method on the snowflake-cortex integration (account-specific issuer, PKCE, loopback callback on 127.0.0.1, refresh, account/role prompts).
• SDK hook now resolves the stored OAuth credential access token; env PAT/TOKEN and options token/apiKey fallbacks unchanged.
• Tests: extended provider-snowflake-cortex.test.ts (method registration, OAuth credential SDK wiring, normalizeAccount/oauthScope helpers). bun typecheck clean, 18/18 tests pass.

Deliberately dropped V1 behavior:

• V1 auto-opened the browser via open() and did the code exchange inside the HTTP handler with a global singleton server + 5min timeout; V2 returns url/instructions with mode auto and exchanges in the attempt callback, with per-attempt scoped servers and the 10min attempt lifetime.
• V1 loader did inline token refresh + 401 retry + fetch Bearer injection; V2 relies on connection.resolve refresh (5min skew) and passes the access token as the SDK apiKey through the existing cortexFetch path.
• V1 error callback replied 200 on OAuth errors; now 400 like the OpenAI pattern.