[stefanvtSAP]

1. cloud-security-client-go

Branch: feat/ias-proof-token-validation

Title

feat(auth): support x5t and IAS proof token validation

Description

## Summary

Add opt-in validation for sender-constrained IAS tokens.

- Validate `cnf.x5t#S256` against the forwarded client certificate when x5t validation is enabled.
- Validate proof tokens for multi-audience service communication through the IAS JWKS request.
- Send the client certificate and `azp_app_tid` to IAS where required.
- Expose IAS consumer service plans through `Token.ServicePlans()`.
- Isolate JWKS cache entries by client, authorized-party tenant, and client certificate.

## Configuration

```go
middleware := auth.NewMiddleware(identity, auth.Options{
    Validation: auth.ValidationOptions{
        X5T:        true,
        ProofToken: true,
    },
})

x-forwarded-client-cert must only be trusted when a proxy strips caller-supplied values and forwards the TLS client certificate.

Validation

• go test ./...
• go vet ./...
• golangci-lint run