Add wrap command for credential injection via HTTP proxy

[kamath]

Summary

• Introduces a new wrap command that runs arbitrary commands with credentials automatically injected via HTTP proxy
• Supports granular access control with optional constraints on services, HTTP methods, paths, and token lifetime
• Adds validation to ensure at least one host is provided in credential profiles
• Improves type safety with explicit WebAssembly import types
• Enhances JSON parsing robustness in HTTP requests

Test plan

• Wrap command spawns child processes correctly with inherited stdio
• Loopback proxy URLs bypass token authentication when no restrictions are applied
• Restricted tokens are minted and embedded in proxy URL when constraints are provided
• Proxy environment variables are properly set on the spawned process
• Signal handling forwards SIGINT and SIGTERM to child processes