Implement configurable OIDC JWT token authentication for ate-api-server.

[Shruti Nair (SHRUTI6991)]

Title

feat(ateapi): support multiple OIDC JWT issuers and Bearer token authentication in kubectl-ate

Summary

Fixes #733.

This PR expands ate-api-server authentication to support multiple, pluggable OIDC JWT providers through an authenticator chain (oidcauth). It replaces the single hardcoded Kubernetes ServiceAccount issuer verifier (k8sjwt) with support for both Kubernetes ServiceAccount JWTs and Human OIDC credentials (e.g., Google accounts).

Additionally, this PR enhances kubectl-ate developer experience by adding a global --token (-t) flag and support for ATE_TOKEN / ATE_API_TOKEN environment variables for authenticating CLI requests to ateapi.

Key Changes

• New oidcauth Package:
  • Replaces cmd/ateapi/internal/k8sjwt with cmd/ateapi/internal/oidcauth.
  • Implements Authenticator and Chain interfaces for sequential evaluation of multiple OIDC issuers.
  • Supports claim extraction mapping (e.g., sub for ServiceAccounts vs. email for human OIDC accounts).
• ate-api-server Configuration:
  • Updates cmd/ateapi/main.go flags to accept --k8s-jwt-issuer, --k8s-jwt-audience, --human-jwt-issuer, and --human-jwt-audience.
  • Constructs an authChain in ateapi server startup to validate incoming bearer tokens.
• kubectl-ate & ateclient Authentication:
  • Adds persistent --token (-t) flag to kubectl-ate root command (cmd/kubectl-ate/internal/cmd/root.go).
  • Updates internal/ateclient/builder.go to check Token variable or ATE_TOKEN / ATE_API_TOKEN environment variables when dialing gRPC services.
• Manifests & Install Scripts:
  • Updates hack/install-ate.sh to configure ATE_API_HUMAN_JWT_ISSUER and ATE_API_HUMAN_JWT_AUDIENCE env vars.
  • Updates manifests/ate-install/ate-api-server.yaml container arguments.

Testing Performed

• Unit Tests:
  • Executed go test ./cmd/ateapi/internal/oidcauth/... to verify OIDC token parsing, signature verification, claim extraction (sub vs email), and authenticator chain evaluation.
  • Executed go test ./internal/ateapiauth/... to ensure server bearer token authentication middleware behavior.
• Repository & Lint Verification:
  • Executed make verify (gofmt, boilerplate headers, go vet, and module tidiness).
• CLI & Integration Verification:
  • Tested kubectl-ate using explicit --token flags and ATE_TOKEN environment variables against local ate-api-server.