feat(gateway): add gRPC server reflection

[2000krysztof]

Summary

WIP
This PR adds functionality to preform reflection calls to get a list of available gRPC endpoints. The reflection call bypasses auth and can be preformed to any gateway without a mTLS or OIDC.

Related Issue

Closes #3058

Changes

• Added tonic-reflection 0.14 to the workspace and gateway dependencies.
• Added gRPC reflection v1 to the primary gateway listener.
• Routed reflection requests through the custom gRPC router.
• Kept reflection independent of OIDC and mTLS user authentication.
• Preserved TLS/mTLS transport requirements when configured.
• Limited reflection to the public OpenShell and Inference schemas.
• Prevented internal driver, interceptor, credential, and middleware schemas from being discoverable.
• Preserved reflection rejection on callback-only compute-driver listeners.
• Added tests for routing, advertised services, schema filtering, and authentication bypass.
• Added README, gateway architecture, and authentication documentation with working grpcurl examples.
• Verified the full server suite: 1,461 passed, 7 ignored.
• Verified a live Podman gateway with grpcurl listing, health invocation, and internal-schema rejection.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.