Negotiate CIMD token endpoint auth method

[alex-feel]

Summary

CIMD documents from live clients (observed with ChatGPT) can declare a preferred token_endpoint_auth_method this server does not support while also publishing a plural token_endpoint_auth_methods_supported list (per OpenID Connect Relying Party Metadata Choices 1.0) that includes a method the server does support (none). The server rejected the whole document without ever consulting that list.

• Add TokenEndpointAuthMethodsSupported to ClientMetadataDocument.
• Negotiate the effective auth method: accept the declared singular method when supported, otherwise fall back to a mutually supported method from the plural list, otherwise reject with the existing error, which now names both fields.
• This follows the same describes-capability-across-every-AS reading already applied to grant_types/response_types filtering for CIMD documents.

Fixes #6278

Type of change

• Bug fix

Test plan

• Manual testing (describe below)

Ran gofmt -l on the changed files, go build, and go vet across pkg/authserver/... and pkg/oauthproto/... (all clean), and go test -count=1 ./pkg/authserver/... ./pkg/oauthproto/... (all packages green).

• Added TestFetch_TokenEndpointAuthMethodNegotiation covering three cases: an unsupported singular method rescued by none in the supported list, an unsupported singular method with no mutually supported method still rejected, and an omitted singular method with a plural list present accepted exactly as before.
• The pre-existing TestFetch_RejectsUnsupportedTokenEndpointAuthMethod is unchanged and still green, so the previously pinned contract for singular-only documents holds.

Changes

File	Change
pkg/oauthproto/cimd/fetch.go	Add the TokenEndpointAuthMethodsSupported []string field to ClientMetadataDocument
pkg/authserver/storage/cimd_decorator.go	Replace the outright-rejection guard with negotiateTokenEndpointAuthMethod; pass the negotiated method into buildFositeClient as a new parameter, removing its internal empty-to-none fallback
pkg/authserver/storage/cimd_decorator_test.go	New negotiation test table; existing rejection test untouched; build-helper calls updated for the new parameter

Does this introduce a user-facing change?

Yes: CIMD clients previously rejected outright for declaring an unsupported preferred token_endpoint_auth_method are now accepted when their token_endpoint_auth_methods_supported list names a method this server supports (none). This is a pure widening: no document accepted today becomes rejected.

Special notes for reviewers

• Two deliberate boundaries: (1) this only widens acceptance, it introduces no new rejections; (2) the server's supported-method set stays the constant none rather than the value the discovery endpoint advertises, because discovery may legitimately advertise client_secret_basic/client_secret_post for other client types, and CIMD documents are never allowed to declare symmetric methods.
• The existing TestFetch_RejectsUnsupportedTokenEndpointAuthMethod test is unchanged and still passes, so the previously pinned contract for singular-only documents holds.

[alex-feel]

Could a maintainer approve the first-contributor workflow runs on this PR and the sibling auth-server PRs (#6283, #6284, #6288)? None of the four has had CI run yet, and green checks should make review easier. I will address whatever the checks surface.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.69%. Comparing base (d278b33) to head (4f321f6).
⚠️ Report is 30 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6400      +/-   ##
==========================================
- Coverage   77.75%   77.69%   -0.06%     
==========================================
  Files         750      750              
  Lines       72601    72609       +8     
==========================================
- Hits        56448    56413      -35     
- Misses      16148    16191      +43     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

Reviewed the negotiation logic (security, code quality, architecture) — looks good. It only ever falls back to "none", never widens into a method the server doesn't already support, so there's no way to sneak past the forbidden symmetric-auth-method check. One minor note: TestBuildFositeClient_TokenEndpointAuthMethodDefault (cimd_decorator_test.go:434) tests a fallback that buildFositeClient no longer applies internally — worth deleting or repurposing to cover the declared-already-"none"-plus-plural-list branch, but not blocking.

[jhrozek]

Could a maintainer approve the first-contributor workflow runs on this PR and the sibling auth-server PRs (#6283, #6284, #6288)? None of the four has had CI run yet, and green checks should make review easier. I will address whatever the checks surface.

Thank you for the contribution and I'm sorry for the long delay in reviews, this shouldn't happen. The last weeks were especially busy. I'll make a pass on your other PRs!