fix(GRL-517): bump reqsign to 0.20 to drop vulnerable jsonwebtoken

[bcrevar-gorules]

Summary

• Bump reqsign 0.17 → 0.20 in core/engine/Cargo.toml, dropping the vulnerable transitive jsonwebtoken pulled in via GCP credential providers.
• Migrate core/engine/src/nodes/function/v2/module/http/auth/providers.rs to reqsign-core 3.x: the ProvideCredential::provide_credential trait now uses native RPITIT (-> impl Future + MaybeSend), so the #[async_trait] wrapper on the CachedProvider impl is removed.
• AWS / GCP / Azure IAM auth signing paths still pass their tests.

Jira

Ticket	Summary
GRL-517	[ZEN] Update reqsign to drop vulnerable jsonwebtoken

🤖 Generated with Claude Code