Use the builder hostname for default request auth #10076

Description

On devnet-8, bombora builder returned HTTP 400 to a caller because auth.message.data differed only by a trailing slash:

Received: https://devnet8-builder-api.bombora.workers.dev/
Expected: https://devnet8-builder-api.bombora.workers.dev

Implement the default auth changes in Beacon API #642 and Keymanager API #94, following builder-specs #168. These proposals use the builder hostname instead of the full URL, so differences in URL formatting do not cause authentication mismatches.

The builder-configuration work in #9864 currently defaults omitted auth data to the full URL bytes.

Steps to resolve

• Derive omitted auth_data in the validator client using the lowercase ASCII hostname, excluding scheme, userinfo, port, path, query and fragment. Follow the specified punycode and IPv6 rules.
• Use the same default for builder preferences and block production, including global and per-validator builder configuration.
• Keep explicitly supplied auth_data as exact opaque bytes. The Keymanager API must not interpret or normalise it.
• Cover the upstream URL examples and explicit overrides in tests, and update configuration documentation and examples.

Builders and validator clients need matching defaults or agreed explicit auth data during the transition. The linked spec PRs are still open.