[WIP] Add Ray Native Token Authentication

[kryanbeane]

DISCLAIMER: This can only be finalized and tested after we bump to Ray v2.52.1 and Kuberay v1.5.1

Issue link

RHOAIENG-39762

What changes have been made

• Added enable_ray_token_auth configuration option (default True) to enable Ray token authentication via KubeRay's authOptions API
• Implemented automatic Ray token retrieval and environment variable setup in SDK, enabling standard ray.init() to work with authenticated clusters

Why

• Enables ray.init() (currently broken with OAuth proxy) Cursor seems to think this - haven't tested it
• adds application-layer token auth alongside network-layer OAuth/OIDC
• SDK handles token retrieval and env vars transparently

Security layers:

• OAuth - Gateway API: Network layer (validates identity for external access)
• Ray Token Auth: Application layer (validates token for all Ray API calls, including pod-to-pod)
  If one layer is bypassed, the other still protects.

Verification steps

N/A

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • Testing is not required for this change

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign pawelpaszki for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kryanbeane]

/hold