Add ECDSA support for OIDC id tokens

[sourishkrout]

This allows well-knowns to contain not just RSA keys.

[Copilot]

Pull request overview

This pull request adds ECDSA (Elliptic Curve Digital Signature Algorithm) support to the OIDC authentication implementation, allowing the system to verify JWT tokens signed with ES256, ES384, and ES512 algorithms in addition to the existing RSA support.

Changes:

• Extended JWKS parsing to handle both RSA and EC (Elliptic Curve) key types
• Updated token verification to accept both RSA and ECDSA signing methods
• Enhanced test infrastructure to generate and verify tokens with both signing algorithms

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/agent/iam/oidc.go	Added EC key parsing in downloadJWKS() with proper curve validation using crypto/ecdh, updated verifyToken() to accept ECDSA signing methods, changed publicKeys map type to any to support both RSA and ECDSA keys, and enhanced TestIDP to generate tokens with both signing methods
pkg/agent/iam/oidc_test.go	Added TestOIDC_DownloadJWKS_EC to verify EC key downloading and parsing, and TestOIDC_VerifyToken_ES256 to test ES256 token verification and interoperability with RS256 tokens

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.