Migrate JWT/JWK auto-refresh from RPCSessions to curl multi singleton

[Copilot]

Migrates JWT/JWK auto-refresh outbound HTTP fetches away from the legacy RPCSessions::create_client() path and onto ccf::curl::CurlRequest attached to CurlmLibuvContextSingleton, following the curl multi singleton direction introduced in #7102.

Core changes

• src/node/jwt_key_auto_refresh.h

  • Fetches both OpenID metadata and JWKS via curl multi singleton requests.
  • Removes the RPCSessions dependency from JwtKeyAutoRefresh.
  • Bounds metadata/JWKS response bodies to 1 MB and sets connect/transfer timeouts.
  • Restricts curl protocols to HTTPS.
  • Verifies peer and hostname using the configured governance CA bundle.
  • Clears libcurl's default CA path so validation is pinned to the configured CA bundle rather than also trusting system roots.
  • Reports curl connection/TLS failures through send_refresh_jwt_keys_error(), so refresh failure metrics include network-level fetch failures.
  • Uses weak ownership plus a stopped flag for scheduled tasks and curl callbacks so late async responses are ignored during shutdown instead of extending auto-refresh lifetime.

• src/node/node_state.h

  • Constructs JwtKeyAutoRefresh without passing rpcsessions.

Metadata and JWKS hardening

• Parses optional OpenID metadata issuer constraints inside the metadata parse error path, so malformed/non-string values are recorded as refresh failures rather than escaping the task.
• Applies metadata issuer constraints to JWKS keys before constructing the internal SetJwtPublicSigningKeys request.
• Validates jwks_uri before handing it to curl:
  • scheme must be HTTPS
  • host and port must match the configured issuer authority, preventing metadata-controlled cross-authority JWKS fetches

Tests

Adds/updates JWT auto-refresh coverage for:

• curl connection failure metrics
• TLS trust failure metrics
• malformed OpenID metadata issuer values
• cross-authority jwks_uri rejection
• refreshed key issuer-constraint propagation

Validated locally:

• scripts/cpp-format-checks.sh
• scripts/python-format-checks.sh
• scripts/python-lint-checks.sh
• cd build && ninja jwt_auth_test js_generic curl_test logging
• cd build && ./tests.sh -VV -R 'jwt_auth_test|programmability_and_jwt'
• cd build && ninja

[achamayou]

@copilot look at the test failures to improve your change.

[Copilot]

@copilot look at the test failures to improve your change.

Fixed three CI failures in commit Fix CI failures: clang-format, CHANGELOG version, JWT test baseline metrics:

1. C/C++ format: Applied clang-format to src/node/jwt_key_auto_refresh.h (long lambda capture lists were not wrapped per style rules).

2. Release notes: Moved the changelog entry from ## [Unreleased] into the existing ## [7.0.6] section under a new ### Changed heading, matching the version in python/pyproject.toml.

3. programmability_and_jwt test failure: The new code calls send_refresh_jwt_keys_error() for curl-level connection failures, which is the observability improvement described in the PR. However, when the test runs a second time after a primary failover (line 794 in jwt_test.py), the new primary fires the auto-refresh while the issuer server is momentarily down — generating a failure count before the test's server starts. The fix captures a baseline_m snapshot right before start_openid_server and changes the assertions to delta comparisons (m["failures"] == baseline_m["failures"]) so pre-existing connection failures from between test invocations are excluded.