Replace api_key with credentials

[hadley]

credentials is a zero-arg callback that returns the API key (or list of other headers). It is called dynamically so that secrets are never stored in the provider object and hence can't accidentally be serialised to disk.

Includes fixes for batch_*() to improve provider hashing and provide an escape hatch if I get the hashing wrong.

Fixes #613

To do:

• Extract out as_credentials(api_key, credentials, function_name)
• Call credentials once to check that it returns the right type of thing
• Use ellmer_req_credentials() in all providers and extend it to optionally take just a string too (need to supply header name in argument)
• Update once Improve provider hashing for batch_chat_*() #802 is merged

[hadley]

@gadenbuie this is a massive PR but you don't need to review it in detail. I think what would be most useful is if you looked at the changes to a couple of chat_ functions and read through the new utils-auth.R to see if it makes sense. I'd also appreciate your comments on whether or not I've motivated the change well, i.e. do you understand the benefits of this approach? (I haven't documented it in huge detail mostly because I don't think many users will need this, but it's very useful to have an as escape hatch we can suggest as needed.)