refactor(security): migrate ACS to retained canonical Config

## Parent

#425

## What to build

让 ACS 项目和叶子直接使用 Security client 保留的 canonical Config。

## Acceptance criteria

- [ ] ACS 不再重建 core Config
- [ ] token provider、headers、timeout 与 response-size 配置保持
- [ ] 代表性 ACS leaf wiremock 测试通过
- [ ] ACS 公开 leaf builder interface 无变化

## Blocked by

- #444
