credentials/alts: support max frame size negotiation via env var (#9268)

Because grpc-go currently does not dynamically negotiate the max frame
size, the connection silently falls back to a default frame size of
4KiB. Moving the default gRPC write-buffer chunk (32KiB) through ALTS at
4KiB forces 9 small encryption calls per chunk. Raising the frame size
to 64KiB lets that 32KiB chunk fit in a single frame, cutting per-chunk
encrypt calls roughly 8x.

To roll this out safely and allow GCS testing before changing the
default behavior, this PR:

- Adds GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable:
Allows configuring the maximum ALTS record frame size (default: 4096
bytes / 4KiB, max: 512KiB). Once GCS validates 64KiB in testing, a
follow-up PR will flip the default value to 65536 (64KiB).

- Adds frame size negotiation in handshaker.go: After handshake
completion, we negotiate the frame size by clamping
GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE against any peer-advertised
max_frame_size from the handshake result (min(peerMax, ourMax)), so we
never write frames larger than a peer can accept.

- Aligns clamping with C++ and Java gRPC: Uses max(4KiB,
negotiatedMaxFrameSize) so NewConn never returns an error when talking
to peers with small or unset max frame sizes.

Benchmark/Profiling: 
see attached files
[consolidated_benchmark_report.md](https://github.com/user-attachments/files/30359695/consolidated_benchmark_report.md)
[consolidated_profiling_report.md](https://github.com/user-attachments/files/30359696/consolidated_profiling_report.md)
The performance gains are more consistent under concurrent workloads (8
and 16 workers), where 64KB shows a stable 2% to 3% average latency
reduction and 3% to 6% P99 reduction.

RELEASE NOTES:
* `credentials/alts`: add `GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE`
environment variable (default 4KiB, max 512KiB) to control ALTS record
frame size and honor peer-advertised `max_frame_size` from the ALTS
handshake result.