Add five API-key access-review connectors

Add Mercury, Apollo.io, Deepgram, ClickHouse Cloud, and Langfuse as
access-review connectors. All are API-key, single-tenant providers
(Pattern 3): the key identifies one tenant, so there is no OAuth flow,
picker UI, or bootstrap/helm configuration.

- Mercury: Bearer token, GET /api/v1/users, cursor pagination.
- Apollo.io: x-api-key header, GET /api/v1/users/search (teammates).
- Deepgram: Token scheme; lists members across every project and
  dedupes by member_id, unioning per-project scopes.
- ClickHouse Cloud: HTTP Basic (keyId:keySecret); discovers the org
  via GET /v1/organizations, then lists its members.
- Langfuse: HTTP Basic (publicKey:secretKey); a base-URL setting
  selects the regional cloud host or a self-hosted instance.

Each adds the enum value, migration, GraphQL binding, provider
Registration, a driver with a cassette-driven test, and a brand logo.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/vcr_test.go

@@ -114,6 +114,20 @@ func basicAuth(username string) string {
 	return "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"))
 }
 
+// basicAuthUserPass returns the HTTP Basic auth header value for a credential
+// that already holds the "username:password" pair ("Basic
+// base64(<credential>)"), or "" if the credential is empty. ClickHouse
+// Cloud (keyId:keySecret) and Langfuse (publicKey:secretKey) present such
+// a credential. The matcher ignores Authorization, so this only matters
+// when re-recording.
+func basicAuthUserPass(credential string) string {
+	if credential == "" {
+		return ""
+	}
+
+	return "Basic " + base64.StdEncoding.EncodeToString([]byte(credential))
+}
+
 // newVCRClient creates an *http.Client backed by the recorder's transport,
 // with an optional Authorization header injected into requests (for recording
 // mode). The authValue should be the complete header value, e.g.