Migrate JWT/JWK auto-refresh from RPCSessions to curl multi singleton

[Copilot]

Migrates JWT/JWK auto-refresh outbound HTTP fetches away from the legacy RPCSessions::create_client() path and onto ccf::curl::CurlRequest attached to CurlmLibuvContextSingleton, following the curl multi singleton direction introduced in #7102.

Core changes

• src/node/jwt_key_auto_refresh.h

  • Fetches both OpenID metadata and JWKS via curl multi singleton requests.
  • Removes the RPCSessions dependency from JwtKeyAutoRefresh.
  • Bounds metadata/JWKS response bodies with the configurable jwt.key_refresh_max_response_size node startup config setting (default 1 MB).
  • Sets bounded connect and transfer timeouts for outbound refresh requests.
  • Restricts curl protocols to HTTPS.
  • Verifies TLS peer certificates and hostnames using the configured governance CA bundle.
  • Clears libcurl's default CA path so validation is pinned to the configured CA bundle rather than also trusting system roots.
  • Reports curl connection/TLS failures through send_refresh_jwt_keys_error(), so refresh failure metrics include network-level fetch failures.
  • Uses weak ownership plus a stopped flag for scheduled tasks and curl callbacks so late async responses are ignored during shutdown instead of extending auto-refresh lifetime.

• src/node/node_state.h

  • Constructs JwtKeyAutoRefresh without passing rpcsessions.
  • Passes the configured jwt.key_refresh_max_response_size value into auto-refresh.

• src/http/curl.h

  • Lowers expected stop-path callback logs from fail to debug.
  • Checks curl_easy_getinfo and curl_multi_get_handles results in curl cleanup paths.
  • Checks curl_slist_append failures without leaking the existing list.

Metadata and JWKS behavior

• Parses optional OpenID metadata issuer constraints inside the metadata parse error path, so malformed/non-string values are recorded as refresh failures rather than escaping the task.
• Applies metadata issuer constraints to JWKS keys before constructing the internal SetJwtPublicSigningKeys request.
• Validates jwks_uri before handing it to curl:
  • URI must parse successfully
  • scheme must be HTTPS
• Allows jwks_uri host/port to differ from the issuer authority. OIDC Discovery requires HTTPS for jwks_uri, but does not require matching issuer/JWKS authorities; Google is a common provider where these authorities differ.

Configuration and docs

• Adds jwt.key_refresh_max_response_size to startup config, JSON config handling, config schema, generated operations docs, test infra config generation, and JWT app docs.
• Moves the PR changelog entries under 7.0.7 and updates python/pyproject.toml to 7.0.7.
• Removes the temporary migration plan document.

Tests

Adds/updates JWT auto-refresh coverage for:

• Initial auto-refresh on primary and after primary failover.
• Curl connection failures incrementing refresh failure metrics.
• TLS trust failures incrementing refresh failure metrics.
• Invalid OpenID metadata issuer fields being recorded as refresh failures.
• Cross-authority HTTPS jwks_uri succeeding.
• Response size limit failures and recovery after restoring metadata.
• Existing auto-refresh behavior and backup-primary auto-refresh coverage.

Validation run locally

• ninja -C build logging curl_test
• cd build && ../tests/.venv/bin/python ../tests/e2e_curl.py
• Direct jwt_test.run_manual(args) against rebuilt build/samples/apps/logging/logging

[achamayou]

@copilot look at the test failures to improve your change.

[Copilot]

@copilot look at the test failures to improve your change.

Fixed three CI failures in commit Fix CI failures: clang-format, CHANGELOG version, JWT test baseline metrics:

1. C/C++ format: Applied clang-format to src/node/jwt_key_auto_refresh.h (long lambda capture lists were not wrapped per style rules).

2. Release notes: Moved the changelog entry from ## [Unreleased] into the existing ## [7.0.6] section under a new ### Changed heading, matching the version in python/pyproject.toml.

3. programmability_and_jwt test failure: The new code calls send_refresh_jwt_keys_error() for curl-level connection failures, which is the observability improvement described in the PR. However, when the test runs a second time after a primary failover (line 794 in jwt_test.py), the new primary fires the auto-refresh while the issuer server is momentarily down — generating a failure count before the test's server starts. The fix captures a baseline_m snapshot right before start_openid_server and changes the assertions to delta comparisons (m["failures"] == baseline_m["failures"]) so pre-existing connection failures from between test invocations are excluded.