Authorize tools from trusted identities - #7827

Reviewed the full diff (21 files, +3052 / -5). This is a well-engineered, security-focused feature with strong design and excellent test coverage. A few non-blocking suggestions below.

Strengths

• Fail-closed by default. Feature disabled by default, frozen at startup, strict validation (length/count limits, no wildcards, ignoreUnknownFields = false), and one immutable authorization snapshot shared by tools/list and tools/call.
• Strong request isolation. KeyAuthAuthentication is a credential-free reference bound to the request's Reactor Context and verified against exchange.getAttributes(); it cannot be borrowed across requests or inherited by disabled/unmatched key-auth execution. The Mono.defer + contextWrite composition (outer clear, inner put) is correct.
• No secret leakage. KeyAuthAuthentication does not override toString, and tests assert the API key never appears in output; forged headers/attributes are ignored. Adapter never logs tokens/claims or copies inbound identity into outbound credentials.
• Optional dependency hygiene. shenyu-plugin-key-auth and the Spring Security modules are optional, guarded by @ConditionalOnClass / ClassUtils.isPresent to avoid hard classpath coupling. Exaclty-one-resolver enforcement (>1 throws) prevents conflicting authorities.
• Excellent tests. Real loopback HTTP (JSON + SSE), concurrent tenant isolation, key rotation, cross-request isolation, error/cancellation, conflicting key-auth/principal sources, and scope vs scp conflicts are all covered.

Non-blocking suggestions

1. aud single-string handling. tokenAuthority calls PrincipalMcpSecurityResolver.names(attributes.get("aud"), false). RFC 7519 allows aud to be a string or array, and Spring Security's getTokenAttributes().get("aud") can be a single String; in that case names(...) throws and the predicate fails closed, silently rejecting a valid token. Consider accepting both String and Collection for aud (and iss).
2. OAuth2-login sub vs principal name. PrincipalMcpSecurityResolver.resolve requires subject == authentication.getName(). For OAuth2AuthenticationToken the name defaults to the name attribute, which may differ from the sub claim in some IdPs. This is documented, but an explicit attribute-name mapping for sub on the login source would avoid silent rejection.
3. AgentMcpIdentity constructor ergonomics. Two public constructors with different parameter orders ((subject, grants) vs (tenant, subject, grants, denials)) are easy to confuse. Consider a single builder, or @Deprecated on the legacy 2-arg constructor with a clear note on which callers need the tenant.
4. Hardcoded FQCN strings. AgentGatewayPluginConfiguration.agentGatewayPlugin mixes "org.apache...PrincipalMcpSecurityResolver".equals(resolver.getClass().getName()) with instanceof KeyAuthMcpSecurityResolver. Use instanceof consistently for readability and refactor safety.

None of these are correctness or security blockers. The change is safe to merge once the maintainers are comfortable with the aud/sub behaviour for their IdP setups.

Approved.