feat: Implement vulnerability token signing and verification utilities

- Added VulnTokenSigner for signing JWT tokens with specified algorithms and keys.
- Introduced VulnTokenUtilities for resolving tenant and subject claims, and sanitizing context dictionaries.
- Created VulnTokenVerificationUtilities for parsing tokens, verifying signatures, and deserializing payloads.
- Developed VulnWorkflowAntiForgeryTokenIssuer for issuing anti-forgery tokens with configurable options.
- Implemented VulnWorkflowAntiForgeryTokenVerifier for verifying anti-forgery tokens and validating payloads.
- Added AuthorityVulnerabilityExplorerOptions to manage configuration for vulnerability explorer features.
- Included tests for FilesystemPackRunDispatcher to ensure proper job handling under egress policy restrictions.

src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressHttpClientFactory.cs

@@ -0,0 +1,45 @@
+using System;
+using System.Net.Http;
+
+namespace StellaOps.AirGap.Policy;
+
+/// <summary>
+/// Provides helpers for creating <see cref="HttpClient"/> instances that respect the configured <see cref="IEgressPolicy"/>.
+/// </summary>
+public static class EgressHttpClientFactory
+{
+    /// <summary>
+    /// Creates an <see cref="HttpClient"/> after validating the supplied egress request against the policy.
+    /// </summary>
+    /// <param name="egressPolicy">The policy used to validate outbound requests.</param>
+    /// <param name="request">Describes the destination and intent for the outbound call.</param>
+    /// <param name="configure">Optional configuration hook applied to the newly created client.</param>
+    /// <returns>An <see cref="HttpClient"/> that has been pre-authorised by the policy.</returns>
+    public static HttpClient Create(IEgressPolicy egressPolicy, EgressRequest request, Action<HttpClient>? configure = null)
+    {
+        ArgumentNullException.ThrowIfNull(egressPolicy);
+
+        egressPolicy.EnsureAllowed(request);
+
+        var client = new HttpClient();
+        configure?.Invoke(client);
+        return client;
+    }
+
+    /// <summary>
+    /// Creates and configures an <see cref="HttpClient"/> after validating the supplied egress request against the policy.
+    /// </summary>
+    /// <param name="egressPolicy">The policy used to validate outbound requests.</param>
+    /// <param name="component">Component initiating the request.</param>
+    /// <param name="destination">Destination that will be contacted.</param>
+    /// <param name="intent">Intent label describing why the request is needed.</param>
+    /// <param name="configure">Optional configuration hook applied to the newly created client.</param>
+    /// <returns>An <see cref="HttpClient"/> that has been pre-authorised by the policy.</returns>
+    public static HttpClient Create(
+        IEgressPolicy egressPolicy,
+        string component,
+        Uri destination,
+        string intent,
+        Action<HttpClient>? configure = null)
+        => Create(egressPolicy, new EgressRequest(component, destination, intent), configure);
+}