Add key-pair authentication to Snowflake Cortex Agent hook

[SameerMesiah97]

Description

This change adds key-pair authentication support to SnowflakeCortexAgentHook, alongside the existing OAuth authentication support.

Rationale

SnowflakeCortexAgentHook previously required an OAuth access token, preventing users with private-key-based Snowflake connections from calling Cortex Agent endpoints. Supporting key-pair authentication aligns the hook with the authentication methods already supported by Snowflake connections.

Tests

Added unit tests verifying that:

• test_get_auth_headers_uses_oauth confirms OAuth authentication is used when an access token is available.
• test_get_auth_headers_uses_keypair_jwt confirms key-pair credentials are used to generate a JWT.
• test_get_auth_headers_raises_when_credentials_missing confirms an error is raised when neither authentication method is configured.
• test_get_auth_headers_raises_when_jwt_generation_fails confirms an error is raised when JWT generation fails.

Backward Compatibility

This change is backward compatible. Existing OAuth connections continue to work as before, while key-pair authentication is available when no OAuth token is configured.

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: [GPT 5.6] following the guidelines

[SameerMesiah97]

@eladkal

I just had another look at the other files in the directory for the snowflake provider hooks, and it appears that snowflake|_sql_api.py has the same prefix as snowflake_cortex_agent.py so it appears that the pattern introduced by AIP-21 is not being consistently applied to all providers. I could remove the prefix from both but if we already have a precedent for prefixing snowflake to the files in the provider, is that really needed? It's your call.

[eladkal]

@eladkal

I just had another look at the other files in the directory for the snowflake provider hooks, and it appears that snowflake|_sql_api.py has the same prefix as snowflake_cortex_agent.py so it appears that the pattern introduced by AIP-21 is not being consistently applied to all providers. I could remove the prefix from both but if we already have a precedent for prefixing snowflake to the files in the provider, is that really needed? It's your call.

Not near my laptop so I can't look but I assume these files were also generated intially by AI who used bad patterns as example? There are very few cases where {provider_name_prefix}_ is right.