Add cluster-level automatic failover support (AutoClusterFailover)

[graham-macdonald-simplisafe]

Summary

The C++ client does not support cluster-level failover — the ability for a Pulsar client to automatically switch from a primary cluster to a secondary cluster when the primary becomes unavailable.

Context

The Java client has supported this since Pulsar 2.10 (May 2022) via AutoClusterFailover and ControlledClusterFailover, both built on the ServiceUrlProvider abstraction. The .NET client (Pulsar.Client) has also independently implemented equivalent functionality via IServiceInfoProvider. The C++ client still lacks this capability. Since the C++ client is the foundation for several language bindings (Node.js, Python), this gap propagates across multiple client ecosystems. Adding cluster-level failover here would bring the C++ client to parity with Java and unblock the same capability in downstream clients.

Proposed Behavior

1. A ServiceUrlProvider (or equivalent) abstraction that allows pluggable URL resolution.
2. An AutoClusterFailover implementation that:

• Accepts a primary service URL and one or more secondary service URLs.
• Runs a background probe task at a configurable checkInterval (default: 30s).
• Switches to the first healthy secondary if the primary is unreachable for longer than failoverDelay (default: 30s).
• Switches back to the primary once it recovers and stays healthy for switchBackDelay (default: 60s).
• Supports per-cluster authentication and TLS configuration.

Use Case

Pulsar deployments with geo-replication across multiple regions need producer clients to automatically failover to a secondary cluster when their local cluster becomes unavailable, without requiring DNS-level failover or application-level detection logic.