[Refactor][Bitbucket] Support Bitbucket API tokens in place of App passwords

[spenpal]

What and why to refactor

Currently, the Bitbucket plugin in Apache DevLake relies on “App passwords” for authentication to Bitbucket Cloud. Bitbucket has announced that on September 9, 2025, creation of App passwords will be discontinued, and on June 9, 2026, all existing App passwords will be deactivated. After these dates, any DevLake connections using App passwords will break and fail to sync Bitbucket data.

To ensure uninterrupted operation and long-term support for Bitbucket integrations, we need to refactor the plugin to support the new Bitbucket API tokens authentication mechanism.

Describe the solution you’d like

1. Support API token authentication
   • Add a new authentication mode in the Bitbucket connector configuration to accept API tokens in lieu of App passwords.
   • Update the DevLake client library to include the Authorization: Bearer <API_TOKEN> header when connecting to Bitbucket Cloud.
2. Migration path and validation
   • Detect at runtime which credential type is provided (App password vs. API token) and validate accordingly.
   • Provide clear error messages if an App password is used post-deprecation or if an API token lacks required scopes.
3. Documentation updates
   • Revise the “Connecting Bitbucket” docs to walk users through generating API tokens, the required scopes (Account:Read, Workspace membership:Read, Repositories:Read, Projects:Read, Pull requests:Read, Issues:Read, Pipelines:Read, Runners:Read), and updating their DevLake blueprint.
4. Backward compatibility and defaults
   • Preserve existing App password support until June 9, 2026 but display deprecation warnings in logs and the UI.
   • Default new installations to require API tokens only.

Related issues

None

Additional context

Bitbucket’s in-product warning when creating App passwords:

[klesh]

LGTM.
Are you going to work on it? I can assign the issue to you if you do.

[spenpal]

@klesh I would love to give it a shot, but unfortunately I don't have time in the near future to do so.

[klesh]

I see. Thanks for the quick response.

[spenpal]

@klesh You can assign this ticket to me. I'll give it a shot.

[klesh]

@klesh You can assign this ticket to me. I'll give it a shot.

Sorry for late response, just got back from holidays.

Thanks for taking the ticket, happy coding. 💪

[klesh]

To move forward more quickly, you could pull in the relevant changes from @petkostas 's PR #8599 to update the Go versions in your own branch.