Allow mapping authentication query columns to user attributes

[jnbdz]

The SQL authentication provider discards every column of the authentication query except the password (row.getString(0)), so callers that need more user data right after login — typically the user id for a session or token — have to run a second query for the row they just fetched.

Following the guidance in #694, this adds a SqlAuthentication.create(client, options, attributeMapper) overload where the mapper is a Function<Row, JsonObject> living on the auth type (options stay data-only). The mapper receives the authenticated row and the returned JSON object is merged into the authenticated User attributes:

AuthenticationProvider provider = SqlAuthentication.create(sqlClient,
  new SqlAuthenticationOptions()
    .setAuthenticationQuery("SELECT password, email FROM users WHERE username = ?"),
  row -> new JsonObject().put("email", row.getString("email")));

Behavior notes:

• the password is still expected in the first column, existing create overloads are unchanged
• a null mapper result is ignored
• a mapper that throws fails the authentication future
• the mapper only runs after the password has been verified

Includes a test in MySQLTest (the DDL gains a nullable email column), an example and documentation.

Fixes #694

[tsegismont]

Thank you @jnbdz

In addition to the comments inline, I think we should put the additional information into the user principal, not the attributes.

In vertx-auth, principal() holds identity data (who the user is) while attributes() holds
authentication metadata (decoded tokens, expiration timestamps, claims).

Every credential-based auth provider in the project (LDAP, htpasswd, htdigest, properties, OTP, WebAuthn, and SQL itself) puts all user data into principal() and leaves attributes() empty.

Only JWT and OAuth2 use attributes(), and exclusively for decoded token structures and timing metadata (accessToken, idToken, exp, iat, nbf, rootClaim, etc.).

Database columns like email or display_name describe the user's identity, they belong in principal().

Merging them into attributes() is inconsistent with the rest of the codebase
and risks colliding with framework-managed keys that control User.expired(), User.subject(), User.get(), and authorization provider lookups.

[tsegismont]

Please add @GenIgnore(GenIgnore.PERMITTED_TYPE)

[tsegismont]

Suggested change

	* Create a JDBC auth provider implementation that enriches the authenticated user with
	* Create a SQL auth provider implementation that enriches the authenticated user with

Could you please also fix the other mentions of JDBC?

[tsegismont]

Can you please reword this part to make it clear that all columns returned by the authentication query are present? Including the hashed password in the first column. And that the user provided function should handle this information with care

[tsegismont]

The mapper call should be wrapped with try/catch, log failures and return a failed future Failure in authentication