feat(proxy): add SPIFFE/SPIRE workload identity auth for upstream routes

[SequeI]

Linked Issue

Closes #1095

Summary

Adds two SPIFFE-based auth flows to the reverse proxy, all configured
under a single spiffe route field:

• JWT-SVID injection: fetches a JWT-SVID from the SPIRE Workload API
  and injects it as a bearer token (or any header) into upstream requests.
  Tokens are cached and refreshed before expiry.

• OAuth2 client assertion (RFC 7523): uses the JWT-SVID as a
  client_assertion in an OAuth2 client_credentials grant, exchanging
  it for an access token at a configured IdP.

All flows are fail-closed: if the SPIRE socket is unreachable at
startup, or credential acquisition fails at request time, the proxy returns
503 rather than forwarding unauthenticated.

Test Plan

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+4312
Lines removed	-545
Total changed	4857
Classification	Large (> 300 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.
• crates/nono-proxy — downstream consumers depend on this crate. API or behaviour changes will affect external callers; treat any breaking change with extra scrutiny.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Broad

This PR touches: source code,CI / build tooling,configuration / policy files

---

_{Updated automatically on each push to this PR.}