docs(rfc): add credential drivers proposal

[TaylorMutch]

Summary

Draft RFC 0007 defining Providers v2 credential drivers for resolving provider-instance credentials from gateway-owner controlled backends.

Related Issue

Related to #1931

Changes

• Adds RFC 0007 for credential driver architecture and contract.
• Covers Providers v2 provider-instance credential references, multiple enabled drivers, defaults, inline compatibility, and no legacy provider v1 extension.
• Defines first-party macOS Keychain, Kubernetes Secrets, OpenBao, and test/static drivers, plus in-tree and UDS loading models.
• Captures OpenBao-on-Kubernetes validation and follow-up e2e automation expectations.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[TaylorMutch]

Backing this up to an issue, and if necessary will push on an RFC if broader alignment is needed from the community.