Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

.env.example

@@ -145,6 +145,11 @@
 # Zendesk OAuth requires a Zendesk-approved global OAuth client (Marketplace).
 # PROBOD_CONNECTOR_ZENDESK_CLIENT_ID=
 # PROBOD_CONNECTOR_ZENDESK_CLIENT_SECRET=
+# Google Analytics (GA4) OAuth (distinct from Google Workspace).
+# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_ID=
+# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_SECRET=
+# PROBOD_CONNECTOR_SQUARE_CLIENT_ID=
+# PROBOD_CONNECTOR_SQUARE_CLIENT_SECRET=
 # PostHog Cloud (US + EU) OAuth needs NO config: it uses the CIMD public-client
 # flow (no app registration, no client_secret), auto-enabled when this
 # deployment is publicly reachable at PROBOD_BASE_URL. Self-hosted PostHog uses