Allow dynamic credentials support in globally configured hostRules

[rarkins]

Tell us more.

This is an idea, to be converted into a feature request issue once it's fully baked.

Inspired by #30541 plus quite a few other requests in the past.

The idea is that we could do something like allow username/password/token to be a JS function, allowing:

• Dynamic fetching of credentials the first time they're needed, and
• Re-fetching of credentials periodically if needed

Proposal:

• allow username, password and token to be a function instead of string, but only if defined in config.js [I think this is the only way it could feasibly be defined]
• By default, fetch them only once per run
• We may need to add some libraries (such as for AWS, GCP, etc) if they are not present in Renovate already
• We need to document how such JS code can depend on the libraries and ensure we don't break that
• Potentially later, add a new hostRules field like refetchCredentialsAfter which optionally lets you define a time period after which the token field should, be refetched/regenerated. This could be used both for tokens which expire after a short period, as well as a way to hack in token rotation/sharing to avoid rate limits