Replace api_key with credentials

[hadley]

credentials is a zero-arg callback that returns the API key (or list of other headers). It is called dynamically so that secrets are never stored in the provider object and hence can't accidentally be serialised to disk.

Includes fixes for batch_*() to improve provider hashing and provide an escape hatch if I get the hashing wrong.

Fixes #613

To do:

• Extract out as_credentials(api_key, credentials, function_name)
• Call credentials once to check that it returns the right type of thing
• Use ellmer_req_credentials() in all providers and extend it to optionally take just a string too (need to supply header name in argument)
• Update once Improve provider hashing for batch_chat_*() #802 is merged

[hadley]

@gadenbuie this is a massive PR but you don't need to review it in detail. I think what would be most useful is if you looked at the changes to a couple of chat_ functions and read through the new utils-auth.R to see if it makes sense. I'd also appreciate your comments on whether or not I've motivated the change well, i.e. do you understand the benefits of this approach? (I haven't documented it in huge detail mostly because I don't think many users will need this, but it's very useful to have an as escape hatch we can suggest as needed.)

[gadenbuie]

Looks great! I think the reason for credentials is well-motivated and clear and the docs all hit the right balance for this feature (agreed that most people don't need to know much, but there's a good escape hatch for edge-cases).

Just a few small comments...

[gadenbuie]

Suggested change

	#' @param credentials A zero-argument function that returns credential to use
	#' @param credentials A zero-argument function that returns the credentials to use

[gadenbuie]

Suggested change

* `chat_*()` functions now use a credentials functions instead of an `api_key` (#613). This means that the `api_key` is never stored in the provider object (which might be saved to disk), but is instead retrieved on demand as needed. You generally shouldn't need to use the `credentials` argument, but when you do, you should use it to dynamically retrieve the API key from some other source (i.e. never inline a secret directly into a function call).

* `chat_*()` functions now use a `credentials` function instead of an `api_key` (#613). This means that API keys are never stored in the chat object (which might be saved to disk), but is instead retrieved on demand as needed. You generally shouldn't need to use the `credentials` argument, but when you do, you should use it to dynamically retrieve the API key from some other source (i.e. never inline a secret directly into a function call).

[gadenbuie]

I don't know if you have much control over this, but given that we often reference functions like across() or pivot_wider(), it's easy to miss that in this error message credentials() means the result of evaluating credentials.