internal/transport: validate metadata returned by per-RPC credentials

### Summary Metadata returned by `credentials.PerRPCCredentials.GetRequestMetadata` is appended to outgoing HTTP/2 request headers after application outgoing metadata has already been validated. The credential metadata keys are lowercased, but invalid keys or invalid non-binary values are not rejected before header construction. ### Why this matters Application metadata and credential-provided metadata should follow the same validation rules before they become transport headers. Without this validation, an in-process credential implementation can inject malformed request metadata even though the same key or value would be rejected if supplied as normal outgoing metadata. This makes metadata validation inconsistent and can result in malformed outgoing HTTP/2 header behavior from credential-provided metadata. ### Environment **gRPC version:** current master at `d74861eb` **Go version:** `go version go1.25.1 X:nodwarf5 linux/amd64` **OS:** `Linux claude 6.16.5-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 04 Sep 2025 23:18:13 +0000 x86_64 GNU/Linux` ### Trigger Use a `PerRPCCredentials` implementation that returns invalid metadata, such as: - a key containing a space - a non-binary metadata value containing a non-printable byte ### Expected behavior Credential metadata should be validated with the same metadata rules used for application outgoing metadata before it is emitted as HTTP/2 headers. ### Actual behavior `http2Client.createHeaderFields` accepts invalid metadata returned by transport-level or call-level `PerRPCCredentials`. ### Proposed fix PR #9202 adds validation for transport-level and call-level per-RPC credential metadata before the metadata is appended to HTTP/2 request headers. It also includes regression tests for invalid credential metadata keys and values.