feat: per-user Globus token + SSL fix for wss:// relay connections

[Anas321]

Summary

• Per-user Globus token submission — passes the authenticated user's Globus token when submitting inference jobs to Lakeshore, enabling per-user SLURM attribution instead of all jobs running under the service account
• SSL fix for wss:// WebSocket connections — explicit SSLContext with system CA bundle passed to all ws_connect calls in globus_compute_client.py and litellm_direct.py; mirrors the same fix applied in hpc-as-api d3ae162
• CI — skip security scanning workflows on the personal backup repo to avoid spurious failures

Root cause (SSL fix)

Globus Compute worker processes on Lakeshore have a custom PYTHONPATH that shadows the system SSL cert store. When websockets.sync.client tried to do the TLS handshake with the relay (wss://), it silently failed — no error, just a 30-second timeout. Non-streaming worked fine because it uses plain HTTP to vLLM (no TLS).

Fix: pass ssl=ssl.create_default_context() with explicit load_verify_locations() for wss:// URLs. ws:// (local/dev) connections are unaffected.

The same fix was applied to uicacer/streamrelay (producer + consumer) so any downstream user of that library also benefits.

Test plan

• Send a streaming request through the full path (gateway → Globus → Lakeshore → relay → consumer) and confirm tokens arrive without timeout
• Confirm non-streaming requests still work
• Confirm ws:// local relay connections still work (dev mode unaffected)
• Build desktop app: pyinstaller stream.spec --noconfirm → STREAM.app launches and can reach Lakeshore

🤖 Generated with Claude Code