[FEATURE REQUEST] support kafka set SASL Mechanism

[John-Funcity]

Why this feature?

aws msk 的SASL/SCRAM 身份验证 认证方式，需要设置SASL设置为SCRAM-SHA-512，可否在config增加该配置项？

Suggested Solution

在sarama.go中增加

       if conf.Username != "" || conf.Password != "" {
		kfk.Net.SASL.Enable = true
		kfk.Net.SASL.User = conf.Username
		kfk.Net.SASL.Password = conf.Password
                # 增加
                kfk.Net.SASL.Mechanism = conf.Mechanism
	}

Additional Information

No response

[jackliu145]

Hi, I'd like to work on this issue after confirming the scope.

I reviewed the current mq/kafka implementation. Setting only Net.SASL.Mechanism is not sufficient:

1. SCRAM-SHA-256/512 also requires SCRAMClientGeneratorFunc in Sarama.
2. AWS_MSK_IAM is a separate authentication path implemented through SASL/OAUTHBEARER, a token provider, TLS, and AWS SigV4 credentials.
3. Producer, consumer, topic verification, and health checks should share the same authentication configuration to avoid inconsistent behavior.

I propose a backward-compatible authentication configuration supporting:

• existing SASL/PLAIN behavior
• SCRAM-SHA-256
• SCRAM-SHA-512
• AWS MSK IAM using the official aws-msk-iam-sasl-signer-go package

Would you prefer keeping #141 focused on SCRAM and opening a separate issue/PR for IAM, or handling both through one shared authentication configuration?

Once the scope is confirmed, I can implement it with unit tests.

[jackliu145]

/assign

[jackliu145]

I am proceeding with #141 focused on backward-compatible PLAIN and SCRAM-SHA-256/512 support. AWS MSK IAM authentication is tracked separately in #256 so each issue has its own branch and PR.