Port gRPC file-watcher certificate provider contracts

Tracks the next focused Bun corpus frontier from #66: js/third_party/grpc-js/test-certificate-provider.test.ts.

Acceptance criteria:

• expose grpc.experimental.FileWatcherCertificateProvider
• validate CA-only, identity-only, and combined configurations while rejecting incomplete identity pairs
• deliver byte-exact CA and identity updates through add/remove listener APIs
• model refresh lifecycle without leaking timers after listeners are removed
• preserve underlying file-read causes and append provider/listener context to error stacks
• pass the focused copied-corpus case and the permanent third-party regression suite

Parent: #66

Completed in 4431bafe217f21697542be36fd17b47e63ca7c32 and pushed to main.

• Ported grpc.experimental.FileWatcherCertificateProvider with upstream-compatible config validation, CA/identity file loading, listener replay/removal, refresh timing, and stale in-flight read protection.
• Added structured configuration errors plus cause-preserving file/listener failures with provider-operation and corpus-file stack frames.
• Added a permanent diagnostic regression for cause/stack behavior and pinned the upstream file in the third-party mini-suite.
• Focused result: 9 passed, 0 todo, 0 failed, 0 unsupported.
• SQL adapter contracts and the complete permanent third-party mini-suite also pass.