feat: Implement vulnerability token signing and verification utilities

- Added VulnTokenSigner for signing JWT tokens with specified algorithms and keys.
- Introduced VulnTokenUtilities for resolving tenant and subject claims, and sanitizing context dictionaries.
- Created VulnTokenVerificationUtilities for parsing tokens, verifying signatures, and deserializing payloads.
- Developed VulnWorkflowAntiForgeryTokenIssuer for issuing anti-forgery tokens with configurable options.
- Implemented VulnWorkflowAntiForgeryTokenVerifier for verifying anti-forgery tokens and validating payloads.
- Added AuthorityVulnerabilityExplorerOptions to manage configuration for vulnerability explorer features.
- Included tests for FilesystemPackRunDispatcher to ensure proper job handling under egress policy restrictions.

src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs

@@ -7,6 +7,7 @@ using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Polly;
 using Polly.Extensions.Http;
+using StellaOps.AirGap.Policy;
 
 namespace StellaOps.Auth.Client;
 
@@ -32,18 +33,21 @@ public static class ServiceCollectionExtensions
         services.AddHttpClient<StellaOpsDiscoveryCache>((provider, client) =>
         {
             var options = provider.GetRequiredService<IOptionsMonitor<StellaOpsAuthClientOptions>>().CurrentValue;
+            EnsureEgressAllowed(provider, options, "authority-discovery");
             client.Timeout = options.HttpTimeout;
         }).AddPolicyHandler(static (provider, _) => CreateRetryPolicy(provider));
 
         services.AddHttpClient<StellaOpsJwksCache>((provider, client) =>
         {
             var options = provider.GetRequiredService<IOptionsMonitor<StellaOpsAuthClientOptions>>().CurrentValue;
+            EnsureEgressAllowed(provider, options, "authority-jwks");
             client.Timeout = options.HttpTimeout;
         }).AddPolicyHandler(static (provider, _) => CreateRetryPolicy(provider));
 
         services.AddHttpClient<IStellaOpsTokenClient, StellaOpsTokenClient>((provider, client) =>
         {
             var options = provider.GetRequiredService<IOptionsMonitor<StellaOpsAuthClientOptions>>().CurrentValue;
+            EnsureEgressAllowed(provider, options, "authority-token");
             client.Timeout = options.HttpTimeout;
         }).AddPolicyHandler(static (provider, _) => CreateRetryPolicy(provider));
 
@@ -135,4 +139,28 @@ public static class ServiceCollectionExtensions
                     }
                 });
     }
+
+    private static void EnsureEgressAllowed(
+        IServiceProvider provider,
+        StellaOpsAuthClientOptions options,
+        string intent)
+    {
+        ArgumentNullException.ThrowIfNull(provider);
+        ArgumentNullException.ThrowIfNull(options);
+        ArgumentException.ThrowIfNullOrWhiteSpace(intent);
+
+        if (options.AuthorityUri is null)
+        {
+            return;
+        }
+
+        var policy = provider.GetService<IEgressPolicy>();
+        if (policy is null)
+        {
+            return;
+        }
+
+        var request = new EgressRequest("StellaOpsAuthClient", options.AuthorityUri, intent);
+        policy.EnsureAllowed(request);
+    }
 }

src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOps.Auth.Client.csproj

@@ -28,6 +28,7 @@
   </PropertyGroup>
   <ItemGroup>
     <ProjectReference Include="..\StellaOps.Auth.Abstractions\StellaOps.Auth.Abstractions.csproj" />
+    <ProjectReference Include="..\..\..\AirGap\StellaOps.AirGap.Policy\StellaOps.AirGap.Policy\StellaOps.AirGap.Policy.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Configuration/StellaOps.Configuration.csproj" />
   </ItemGroup>
   <ItemGroup>
@@ -44,4 +45,4 @@
       <_Parameter1>StellaOps.Auth.Client.Tests</_Parameter1>
     </AssemblyAttribute>
   </ItemGroup>
-</Project>
+</Project>