Enforce Cedar policies on upstream IDP token claims

[tgrunnagle]

Summary

• Cedar policies could not reference upstream IDP claims (e.g. GitHub login, Okta groups) because the Cedar authorizer always evaluated against ToolHive-issued JWT claims, while upstream tokens stored in identity.UpstreamTokens were never read.
• Two additional gaps made group-based policies entirely non-functional: Identity.Groups was never populated despite a code comment saying authorization logic "MUST" do this extraction, and CreatePrincipalEntity always produced empty Parents sets, making principal in THVGroup::"engineering" always evaluate to false.
• This PR wires all three gaps: adds a PrimaryUpstreamProvider config option to the Cedar authorizer so it can read upstream IDP token claims, adds ExtractGroupsFromClaims to populate groups from those claims, and updates CreatePrincipalEntity/CreateEntitiesForRequest to build the THVGroup parent entity hierarchy so Cedar's in operator works for group membership.

Closes #4408

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
pkg/auth/identity.go	Add ExtractGroupsFromClaims with configurable claim name and well-known defaults (groups, roles, cognito:groups)
pkg/authz/authorizers/cedar/core.go	Add PrimaryUpstreamProvider and GroupClaimName to ConfigOptions/Authorizer; add parseUpstreamJWTClaims; add InjectUpstreamProvider; branch in AuthorizeWithJWTClaims to resolve claims from upstream token when configured; pass extracted groups into all authorize sub-methods
pkg/authz/authorizers/cedar/entity.go	Update CreatePrincipalEntity to accept a groups slice and create THVGroup parent entities; update CreateEntitiesForRequest to accept and forward groups
pkg/runner/middleware.go	Add injectUpstreamProviderIfNeeded helper; call it when building the authz middleware config so Cedar uses upstream IDP claims whenever the embedded auth server is active
pkg/runner/config_builder.go	Propagate embeddedAuthServerCfg into addAuthzMiddleware so the Kubernetes operator code path also injects the upstream provider name
pkg/vmcp/config/config.go	Add PrimaryUpstreamProvider field to AuthzConfig
pkg/vmcp/auth/factory/incoming.go	Forward PrimaryUpstreamProvider from vMCP AuthzConfig into cedar.ConfigOptions

Does this introduce a user-facing change?

Operators using Cedar policies with the embedded auth server can now write policies that reference upstream IDP claims (e.g. a GitHub login or Okta groups claim) by setting primary_upstream_provider in the Cedar config options. Group-based policies using principal in THVGroup::"<group-name>" now evaluate correctly when the upstream token carries a standard group claim.

Special notes for reviewers

The upstream token's JWT signature is intentionally not re-verified. The token was already validated by the IDP during the OAuth 2.0 code exchange; re-verification would require a round-trip to the IDP's JWKS endpoint on every authorization call and provides no security benefit in this trust model. If the upstream token is an opaque (non-JWT) token rather than a JWT access token, the authorizer returns an error and denies the request — there is no silent fallback to ToolHive claims, which is deliberate to prevent misconfigured deployments from authorizing against unintended claims.

The InjectUpstreamProvider function in core.go is a no-op for non-Cedar authorizer configs, making it safe to call unconditionally from the runner middleware without needing to know the authorizer type ahead of time.

Large PR Justification

• Closes singular github issue tracking Cedar policy gaps

Generated with Claude Code

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

[codecov]

Codecov Report

❌ Patch coverage is 89.60000% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.63%. Comparing base (e69251a) to head (f53a8ef).
⚠️ Report is 15 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/runner/config_builder.go	57.89%	4 Missing and 4 partials ⚠️
pkg/runner/middleware.go	80.00%	2 Missing and 1 partial ⚠️
pkg/authz/authorizers/cedar/core.go	97.18%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4448      +/-   ##
==========================================
- Coverage   69.64%   69.63%   -0.02%     
==========================================
  Files         491      497       +6     
  Lines       50304    50685     +381     
==========================================
+ Hits        35036    35294     +258     
- Misses      12580    12682     +102     
- Partials     2688     2709      +21     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Large PR justification has been provided. Thank you!

[github-actions]

✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review.

[JAORMX]

LGTM, left some questions and minor follow-ups.