fix(identity): harden HTTP clients and add TLS cert pinning for JWKS fetch (PILOT-241)

[matthew-pilot]

What changed

sharedHTTPClient hardening

• Disabled HTTP redirects on the identity webhook HTTP client (previously followed up to 10 redirects by default)
• Enforced TLS 1.2 minimum version

TLS certificate pinning for JWKS fetch (PILOT-241)

• New jwksPinnedHTTPClient() helper that returns a hardened HTTP client which verifies the server TLS certificate fingerprint (SHA-256 of DER-encoded cert) against a configured pin
• New GetKeyWithPinning() method on JWKSCache — fetches JWKS keys with optional TLS fingerprint verification
• New FetchJWKSKeysWithPinning() exported function for direct use by external callers
• HandleValidateToken now uses the Store’s pinned fingerprint (when configured) during JWKS key fetch
• Store.SetPinnedCertFingerprint() / Store.GetPinnedCertFingerprint() for runtime configuration

Why

PILOT-241 reported that the OIDC/JWKS fetch path followed up to 10 redirects and had no TLS certificate pinning. The redirect + TLS minimum version parts were already addressed via jwksHTTPClient in the original implementation. This PR:

1. Extends the same hardening to sharedHTTPClient (used by the identity webhook path)
2. Adds certificate pinning infrastructure to prevent MITM attacks during JWKS key fetch

Verification

• go build ./... — clean
• go vet ./... — clean
• go test ./... — all passing (including identity package)

Closes PILOT-241

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!