[codex] expand ASB verifier security tests

[haasonsaas]

Summary

• add the missing ASB sessionjwt edge-case coverage for expiration, signing method, tampering, and required-claim variants
• expand OIDC verifier coverage for empty subject-prefix config, expiration, future nbf, and wrong signing algorithm
• harden the OIDC verifier to reject signing methods that do not match the configured public-key type

Why

asb#61 calls out missing security-sensitive coverage around session JWT validation and OIDC attestation verification. The issue text is partially stale because sessionjwt already had a baseline test file, but the high-risk edge cases were still uncovered, and the OIDC verifier did not explicitly pin signing methods to the configured key type.

Validation

• repo commit hook
  • gofmt on staged files
  • golangci-lint
  • go test ./...
• focused reruns during development
  • go test ./internal/authn/oidc ./internal/crypto/sessionjwt -count=1
  • GOTOOLCHAIN=go1.26.0 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 run ./internal/authn/... ./internal/crypto/sessionjwt
  • git diff --check

Scope

This is a first bounded slice of asb#61. It covers the verifier and session-token security tests only; the durable audit sink, Helm chart, connector hardening, and remaining test gaps stay out of scope for this PR.

[cursor]

PR Summary

Medium Risk
Touches token verification logic in an authentication-critical path by adding signing-method restrictions; behavior changes could reject previously-accepted tokens if key/alg configuration is inconsistent.

Overview
Hardens OIDC JWT attestation verification by rejecting tokens whose alg does not match the public-key type returned by Keyfunc (Ed25519/RSA/ECDSA), preventing algorithm/key-type confusion.

Expands security-focused tests for both internal/authn/oidc and internal/crypto/sessionjwt to cover subject-prefix behavior when unset, expiration and nbf validation failures, unexpected signing methods, missing required claims, and tampered signatures (plus small test refactors via shared helpers).

^{Reviewed by Cursor Bugbot for commit cee26c3. Bugbot is set up for automated code reviews on this repo. Configure here.}