Add AUTH/AUTH2 options to CLUSTER MIGRATESLOTS

[nemtsv]

Fixes #2392.

CLUSTER MIGRATESLOTS currently authenticates to target nodes using the
source node's masteruser/masterauth. This adds optional
per-target AUTH/AUTH2 support, matching the existing MIGRATE command syntax.

New syntax:

CLUSTER MIGRATESLOTS SLOTSRANGE start end NODE node-id [AUTH password | AUTH2 username password]

When AUTH/AUTH2 is omitted, behavior is unchanged (falls back to masteruser/masterauth).

Changes:

• added auth_user/auth_password fields to slotMigrationJob
• extend command parser to accept AUTH/AUTH2 after each NODE argument
• updated slotMigrationJobSendAuth to prefer per-job credentials over globals
• redacted password arguments in slow log / MONITOR (matching MIGRATE behavior)
• zero on free for credentials
• update command JSON schema and help string

Tests:

• test for AUTH/AUTH2 happy path
• test for wrong password
• test for syntax errors
• test for per-job auth overriding masterauth
• test for multi-target with mixed types of credentials
• test for user/password command redaction

TODO:

• [] PR for valkey-doc repo needed

[madolson]

Implementation seems reasonable. One thing to consider is whether we need both AUTH and AUTH2. The new HELLO command requires username and password, so maybe we should just require username and password here and skip the AUTH/AUTH2 split. One blocker around binary safety.

[madolson]

blocker: strlen(user) and strlen(pass) are not binary safe. The old code used sdslen(server.primary_auth) for the password, which correctly handles embedded null bytes. This PR changes it to strlen(pass), which truncates at the first \0.

This regresses all three call sites, not just the new migration path — the two existing replication callers also pass server.primary_auth (an sds) through strlen now.

For comparison, MIGRATE uses sdslen(username) and sdslen(password) (cluster.c ~line 538-540).

Fix: add length parameters to the signature:

sds replicationSendAuth(connection *conn, const char *user, size_t user_len, const char *pass, size_t pass_len);

Callers pass sdslen() for sds values and strlen() for char * values. This also makes the binary-safety contract explicit at each call site.

[madolson]

minor: server.primary_user is char *, not sds. Assigning it to an sds variable works (both are char *) but is misleading. Use const char * for both locals, which also matches the replicationSendAuth signature.

[madolson]

nit: The if guard is unnecessary — sdsfree handles NULL. The if (auth_pass) guard is needed for the memset, but this one is just noise. Same in freeSlotMigrationJob at line 2211. Optional to clean up.