feat(authentication_policy): support PROGRAMMATIC_ACCESS_TOKEN method and PAT_POLICY

[GClunies]

What & Why

Snowflake authentication policies now govern Programmatic Access Tokens (PATs), but snowcap's AuthenticationPolicy can't express any of it:

• AuthenticationMethods enum (snowcap/resources/authentication_policy.py) only has ALL, PASSWORD, SAML, OAUTH, KEYPAIR — no PROGRAMMATIC_ACCESS_TOKEN.
• No PAT_POLICY property (network_policy_evaluation, default_expiry_in_days, max_expiry_in_days).

So any policy that allows or constrains PAT usage has to be written as manual SQL. (Creating PATs themselves is inherently non-declarative — the secret is returned exactly once — so that's out of scope; this issue is only about the policy side.)

Example of what we'd like to declare:

CREATE AUTHENTICATION POLICY service_user_auth_policy
  AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN', 'KEYPAIR')
  PAT_POLICY = (
    NETWORK_POLICY_EVALUATION = ENFORCED_REQUIRED,
    DEFAULT_EXPIRY_IN_DAYS    = 30,
    MAX_EXPIRY_IN_DAYS        = 365
  );

Acceptance Criteria

• PROGRAMMATIC_ACCESS_TOKEN added to AuthenticationMethods
• pat_policy property supported (network_policy_evaluation, default_expiry_in_days, max_expiry_in_days)
• Fetch/plan round-trips policies containing these fields without spurious drift
• Docs page updated

Resources

• Snowflake docs: CREATE AUTHENTICATION POLICY, programmatic access tokens
• Snowcap: snowcap/resources/authentication_policy.py lines 11–16 (enum), no PAT_POLICY prop