feat(platform/bitbucket): support mixed auth (workspace access token + personal api token)

[setchy]

Changes

Update http client auth fn to support mixed authentication for Bitbucket Cloud.

Workspace Access Tokens have significantly higher API rate limits, however there are no permissions currently for Issues read/write, which is required for those using Dependency Dashboard within Bitbucket Cloud.

This update falls back to username + password auth for /issue operations, while all others will use token when present.

Context

Workspace Access Tokens

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

[setchy]

@viceice - would appreciate some general input on the direction here

[viceice]

I don't think we like this quirk.

Are there any plans that the token will support the required permissions any time in future?

[setchy]

I don't think we like this quirk.

I agree, very quirky...

The elevated rate limits for workspace tokens make this all worth exploring.

Are there any plans that the token will support the required permissions any time in future?

I've reached out to their Product Owner to check, but I'm doubtful since BB issues are a legacy feature in many ways...

[setchy]

Open to other ideas on how to best change this. Moving back to draft while we discussion best paths forward