[Identity] Implement OIDC authentication and principal modeling #22

Outcome

Authenticate people and workloads through explicit, configurable trust anchors.

Scope

• Validate configured issuers and normalize subject, issuer, audience, groups, and workload identity into a principal.

Acceptance criteria

• Issuer, audience, algorithm, signature, expiry, clock-skew, and JWKS rotation tests pass.
• Human and workload flows are distinct and anonymous behavior is explicit.
• Raw tokens never enter logs, traces, errors, audit payloads, or resources.

Test and evidence

• Negative token corpus and redaction canary results.

Dependencies

• Blocked by #16.
• Blocked by #17.
• Blocked by #14.

References

• Security model
• OAuth 2.0 Security Best Current Practice (RFC 9700)