feat(security_integration): implement custom OAuth integration (OAUTH_CLIENT = CUSTOM)

[GClunies]

What & Why

Custom OAuth security integrations (TYPE = OAUTH, OAUTH_CLIENT = CUSTOM) are how external OAuth clients — e.g. Claude.ai's Snowflake MCP connector, custom apps — authenticate to Snowflake. Snowcap explicitly does not support them: _resolver in snowcap/resources/security_integration.py raises NotImplementedError for OAuthClient.CUSTOM (there's a commented-out SnowflakeCustomOAuthSecurityIntegration stub).

We manage this via manual SQL today:

CREATE SECURITY INTEGRATION IF NOT EXISTS claude_mcp_oauth
  TYPE                          = OAUTH
  ENABLED                       = TRUE
  OAUTH_CLIENT                  = CUSTOM
  OAUTH_CLIENT_TYPE             = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI            = 'https://claude.ai/api/mcp/auth_callback'
  OAUTH_ALTERNATE_REDIRECT_URIS = ('https://claude.com/api/mcp/auth_callback')
  OAUTH_ISSUE_REFRESH_TOKENS    = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY  = 7776000
  OAUTH_USE_SECONDARY_ROLES     = IMPLICIT
  OAUTH_ENFORCE_PKCE            = TRUE;

ALTER SECURITY INTEGRATION claude_mcp_oauth SET NETWORK_POLICY = anthropic_mcp_policy;

Lifecycle caveat that makes declarative support valuable: recreating the integration (OR REPLACE) rotates the OAuth client_id/client_secret and breaks live clients — updates must go through ALTER ... SET.

Acceptance Criteria

• SnowflakeCustomOAuthSecurityIntegration resource supporting: oauth_client_type, oauth_redirect_uri, oauth_alternate_redirect_uris, oauth_issue_refresh_tokens, oauth_refresh_token_validity, oauth_use_secondary_roles, oauth_enforce_pkce, network_policy, pre_authorized_roles_list, blocked_roles_list
• Updates are applied via ALTER — the lifecycle never recreates the integration for property changes (client credential rotation breaks live clients)
• Non-fetchable fields (client secret) handled like the existing partner OAuth resource
• Fetch/plan round-trip without spurious drift
• Docs page under docs/resources/

Resources

• Snowflake docs: CREATE SECURITY INTEGRATION (Snowflake OAuth)
• Snowcap: snowcap/resources/security_integration.py — _resolver raises NotImplementedError for OAuthClient.CUSTOM