Part of https://linear.app/sourcegraph/issue/CORE-211

This introduces authenticated proxies that allow dotcom site admins
access to dev and production Enterprise Portal instances, authenticated
with client credentials issued to the dotcom instance. The medium-term
goal is to use this proxy so that we can use the existing subscriptions
UI, backed by the new Enteprise Portal deployments (e.g.
https://github.com/sourcegraph/sourcegraph/pull/63653, tracking issue:
https://linear.app/sourcegraph/issue/CORE-100/enterprise-portal-migrate-away-from-dotcom-db-as-source-of-truth),
until we have a dedicated UI for Enterprise Portal
(https://linear.app/sourcegraph/project/kr-p-enterprise-portal-user-interface-dadd5ff28bd8)

This is required until we ship
https://linear.app/sourcegraph/project/kr-p1-streamlined-role-assignment-via-sams-and-entitle-2f118b3f9d4c/overview,
which will allow SAMS to be the source-of-truth for who is a site admin
in Sourcegraph.com. Once we have that information, we can use the user's
SAMS session directly in Enterprise Portal to authorize access to
Enterprise Portal data.

## Test plan

Set up `dev-private` with dev credentials:
sourcegraph/dev-private#101

`sg start dotcom`, create a personal access token, and try to make
ConnectRPC requests matching the spec to the new endpoints:

```sh
# Local
curl --header "Content-Type: application/json" --header "authorization: token sgp_local_..." --data '{"filters":[{"filter":{"is_archived":false}}]}' -v  \
    https://sourcegraph.test:3443/.api/enterpriseportal/local/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions
# Dev
curl --header "Content-Type: application/json" --header "authorization: token sgp_local_..." --data '{"filters":[{"filter":{"is_archived":false}}]}' -v  \
    https://sourcegraph.test:3443/.api/enterpriseportal/dev/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions
```

Note that the URL path after `/.api/enterpriseportal/dev/`, i.e.
`/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions`,
and the shape of the parameters, are all the same as if you curl'd the
Enterprise Portal API directly, per the Connect protocol:
https://connectrpc.com/docs/protocol/

Both local and dev reach out to the existing SAMS dev deployment for
credentials, so the `dev-private` credentials work OOTB for both.

---------

Co-authored-by: Andre Eleuterio <andreeleuterio@users.noreply.github.com>