Support all REST vended credential paths

[kevinjqliu]

Summary

PyIceberg supports inline REST storage-credentials on table responses, but not every vended credential path in the REST Catalog spec.

Related: #2594

Gaps

• Implement loadCredentials: GET /v1/{prefix}/namespaces/{namespace}/tables/{table}/credentials, including LoadCredentialsResponse, longest-prefix selection, and optional planId / referenced-by.
• Complete scan-planning credential support: apply storage-credentials from completed planTableScan / fetchPlanningResult responses when reading planned data/delete files, and add the missing async fetchPlanningResult flow.
• Revisit staged create: credential resolution currently depends on metadata-location, which can be null for staged table metadata.

Done When

• Explicit loadCredentials responses are parsed and applied.
• Scan-planning credentials are used for planned file reads.
• Existing inline table-response precedence is preserved: matching storage-credentials win over config.