add token vault feature

[psarna]

Adds token vault capabilities which translate auth tokens
on the fly, so that the proxees do not actually ever see
the real tokens.

Flow:

$ ./sandworm token add bearer --host api.github.com --secret "$GITHUB_API_TOKEN"
created bearer mapping "api.github.com" for api.github.com * using proxy token "default"
$ ./sandworm token list
default
  - bearer api.github.com *

$ ./sandworm --domains api.github.com --translate-tokens
time=2026-04-27T09:45:37.688+02:00 level=INFO msg="Starting proxy" addr=0.0.0.0:2137 mode=allow allowed_domains=[api.github.com] allowed_cidrs=[] blocked_domains=[] blocked_cidrs=[]
time=2026-04-27T09:45:37.688+02:00 level=INFO msg="Starting admin panel" addr=127.0.0.1:2138
time=2026-04-27T09:45:37.688+02:00 level=INFO msg="Proxy started successfully" port=2137 admin_bind=127.0.0.1 mode=allow domains=[api.github.com] cidrs=[] blocked_domains=[] blocked_cidrs=[] translate_tokens=true translate_tokens_db=./sandworm.db

time=2026-04-27T09:52:49.262+02:00 level=INFO msg="Proxy request" method=CONNECT host=api.github.com:443 url=//api.github.com:443 remote=127.0.0.1:58068
time=2026-04-27T09:52:59.189+02:00 level=INFO msg="Proxy request" method=CONNECT host=api.github.com:443 url=//api.github.com:443 remote=127.0.0.1:43258
time=2026-04-27T09:53:02.509+02:00 level=INFO msg="Proxy request" method=CONNECT host=api.github.com:443 url=//api.github.com:443 remote=127.0.0.1:54504

$ . <(./sandworm token config)
$ echo $HTTPS_PROXY
http://x:sand_-khhQ0jx0wOPxaoyGajlCdchfBWB-ZXu@127.0.0.1:2137

$ curl -sSfL https://api.github.com/user | jq -r '.name,.company'
Piotr Sarna
poolside

Revoking path:

$ ./sandworm token revoke
revoked proxy token "default"
$ ./sandworm token list
default
  - no mappings

$ curl -sSfL https://api.github.com/user | jq -r '.name,.company'
curl: (22) The requested URL returned error: 401