Support oauth2

[BatoWa]

Summary

Adds OAuth2 (3LO) authentication support for Jira Cloud to the Defect Service,
alongside the existing basic, token, and oauth1 strategies. Because
OAuth2 (and Cloud scoped API tokens) only work through the Atlassian API
gateway, this branch also introduces the gateway connection path and fixes the
URL-generation issues that come with it.

Motivation

Jira Cloud is moving toward OAuth2 / scoped API tokens, which are not accepted
by the direct site URL — they must go through api.atlassian.com/ex/jira/{cloudId}.
The service needed a first-class OAuth2 flow (token lifecycle, refresh, setup
wizard) and had to keep user-facing URLs pointing at the configured Jira site
rather than the internal gateway host.

What changed

OAuth2 authentication

• New auth_type = "oauth2" in JiraDefectClientConfig, with oauth2_client_id,
  oauth2_client_secret, and oauth2_refresh_token (env-var overridable, e.g.
  JIRA_OAUTH2_CLIENT_ID). Validated in validate_config.
• New clients/jira/jira_oauth.py: module-level token store persisted to
  tmp/oauth2_tokens.toml, refreshed against auth.atlassian.com/oauth/token,
  and injected per-request via a session send patch.
• Setup wizard flow to retrieve and authorize an initial OAuth2 token.

Gateway connection path

• _connect_via_gateway connects through api.atlassian.com/ex/jira/{cloudId},
  resolving the cloud ID from the public /_edge/tenant_info endpoint.
• Session-level patching transparently routes site-URL requests to the gateway
  and injects the bearer token, so callers stay gateway-agnostic.

Correct user-facing URLs under the gateway (permalinks & attachments)

• create_defect_from_issue / create_extended_defect_from_issue /
  _extract_references now accept a site_url (the configured server_url)
  and build permalinks and attachment URLs against the Jira site instead of the
  gateway host. Previously references pointed at api.atlassian.com/ex/jira/….
• Fixed an UnboundLocalError in _extract_references for issues with no
  attachments.

Docs & tests

• Updated docs/clients/jira-client.md, docs/cli.md, and migration docs.
• Added unit tests: test_jira_oauth.py, plus TestExtractReferences and
  site_url coverage in test_utils.py.

Notes for reviewers

• Attachment URLs are currently hardcoded to the /rest/api/2/… REST base;
  tracking the actual API version is intentionally deferred.
• No real tokens/secrets are committed; tmp/oauth2_tokens.toml and
  config.toml remain local-only working artifacts.