Add ate-idp-server to serve the discovery document and key set for actor JWTs - #2099

…ubstrate#2132)

Part of agent-substrate#1756.

- Adds `localjwtauthority.JWKS`, which turns a pool's verification keys
into the JWK set relying parties fetch, sorted by key ID. It encodes the
keys in-tree with the RFC 7518 parameters, padding EC coordinates to the
curve size.
- Rejects an empty set, missing or duplicate key IDs, and an algorithm
that doesn't fit its key, so a bad pool can't publish a set verifiers
would reject.
- `localjwtauthority.VerificationKey` gains `Algorithm`.
- `Thumbprint` moves from `oidcdiscovery` to `localjwtauthority`, since
key IDs belong to the pool. It is now the base64url SHA-256 of the key's
PKIX encoding, as the Kubernetes service account issuer derives `kid`,
instead of go-jose's RFC 7638 thumbprint. Pools store each key's ID, so
existing keys keep theirs. go-jose is no longer imported; it stays in
go.mod as an indirect dependency.

Nothing calls `JWKS` yet; ate-idp-server (agent-substrate#2099) will.

Testing: the RFC 7517 and RFC 7638 example keys, thumbprints checked
against openssl, EC coordinate padding, a round trip that decodes keys
back to the originals, and the rejection cases. E2E can't cover it until
it's deployed.

- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR

…tor JWTs (agent-substrate#2099)

Part of agent-substrate#1756.

- Adds `cmd/ate-idp-server`, which serves
`/.well-known/openid-configuration` and `/openid/v1/jwks` over HTTPS
with a servicedns credential bundle, so relying parties can verify actor
JWTs.
- Reads the actor JWT authority pool from `--actor-id-jwt-pool` with
`localjwtauthority.RefreshingPool`, the reader ate-api-server signs
with, and builds each document from it per request.
- Builds both documents at startup and exits if it can't. After that, a
request whose document can't be built gets a 500 rather than an empty or
stale set.
- Requires `--issuer` rather than deriving a default, so it can't
disagree with ateapi, and accepts only `https://<host>`, so the routes
are fixed. The check is the new `actoridjwt.ValidateIssuer`; the
discovery document moves out of `internal/oidcdiscovery` into the
server, its only user.
- Makes the EC case in `localjwtauthority.JWKS` explicit: P-256 with
fixed 32-byte coordinates and an error for any other curve, rather than
reading the coordinate size off the encoded point.
- Records in `docs/metrics/substrate.yaml` that it emits no metrics.

For reviewers: the pool holds the signing keys, so ate-idp-server will
mount the same Secret ate-api-server does, in place of the controller
and ConfigMap in agent-substrate#2134. ate-api-server and ate-setup still accept an
issuer with a path until the installer deploys ate-idp-server. It serves
`/healthz` but no `/readyz`. Nothing deploys it yet.

Testing: unit tests for routing, the host-only issuer check, the
discovery document, startup failures, key changes, 500s on a broken set,
the P-256 encoding, and required flags, plus a local run over TLS
against a generated pool. E2E can't cover it until it's deployed.

- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR

(cherry picked from commit 0877906)
Signed-off-by: Timo Derstappen <[email protected]>