This partially backports various dependencies of the original change.
Note that this is not a clean backport, and minor code and
organizational changes were made to facilitate this backport,
including copying some OIDC code directly into the token validator.

Additionally, caching support from #57789 was integrated directly. It
inherently depends on the same OIDC code that required modification,
so it has been pulled in directly.

This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
  library to cache internally. It currently has no internal method
  for invalidating old keys, so we purge the `oidc.KeySet` regularly.
  However, upon encountering an unknown `kid`, the library will
  attempt to fetch new keys on its own.

This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.

I've abandoned the caching approach in #57789, so this PR will proceed
without caching, as in branch/v18.

* [v18] Add new `oidc` subtype for Kubernetes joining (#57538) (#57683)

* MWI: Add `oidc` subtype for Kubernetes joining

This adds a new `oidc` subtype for Kubernetes joining, which allows
workloads to join using a Kubernetes service account token (JWT)
as usual, but verifies it using an OIDC flow rather than a static JWKS
keyset. This should better support platforms like EKS where the JWKS
keyset is rotated regularly.

* Validate OIDC subtype properly

* Initialize OIDC validator at startup

* Fix OIDC claims implementation

* Force use of cluster name as audience

* Remove authorized party workaround

* Reintroduce kubernetes claims check

* Remove unused constant

* Update generated operator resources

* Update generated TF docs

* Add validator tests

* Improve proto docs, enforce HTTP issuers, and add insecure override

* Update autogenerated docs

* Partially backport OIDC changes to fix build, include #57789

This partially backports various dependencies of the original change.
Note that this is not a clean backport, and minor code and
organizational changes were made to facilitate this backport,
including copying some OIDC code directly into the token validator.

Additionally, caching support from #57789 was integrated directly. It
inherently depends on the same OIDC code that required modification,
so it has been pulled in directly.

* Remove caching support from the backport

I've abandoned the caching approach in #57789, so this PR will proceed
without caching, as in branch/v18.

* Add a caching OIDC validator for use with Kubernetes OIDC

This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
  library to cache internally. It currently has no internal method
  for invalidating old keys, so we purge the `oidc.KeySet` regularly.
  However, upon encountering an unknown `kid`, the library will
  attempt to fetch new keys on its own.

This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.

* Manage validator instances by issuer; use in Kubernetes validator

This adds an indirection layer to automatically manage validator
instances as cached data is specific to a particular (issuer,
audience) combination.

Additionally, this swaps the new caching validator in in place of the
standard non-caching validator.

* Fix comments and add missing mutex lock

* Add tests for the caching validator

* Fix lints

* Add logging

* Fix imports

* Code review suggestions: atomic expiry, misc fixes

This changes `validatorExpires` to be an atomic int64, which removes
a locks from `Expires()` / `IsStale()` and ensures an ongoing pruning
won't block `ValidateToken()`.

* Replace validator cache and pruning with `utils.FnCache`

This swaps the hand-rolled cache for validators with utils.FnCache,
since it's more robust and its TTL mechanism works properly for our
needs.

* Remove commented out test code

* Fix build errors and enable ReloadOnErr

* Code review suggestions

* Add a caching OIDC validator for use with Kubernetes OIDC

This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
  library to cache internally. It currently has no internal method
  for invalidating old keys, so we purge the `oidc.KeySet` regularly.
  However, upon encountering an unknown `kid`, the library will
  attempt to fetch new keys on its own.

This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.

* Manage validator instances by issuer; use in Kubernetes validator

This adds an indirection layer to automatically manage validator
instances as cached data is specific to a particular (issuer,
audience) combination.

Additionally, this swaps the new caching validator in in place of the
standard non-caching validator.

* Fix comments and add missing mutex lock

* Add tests for the caching validator

* Fix lints

* Add logging

* Fix imports

* Code review suggestions: atomic expiry, misc fixes

This changes `validatorExpires` to be an atomic int64, which removes
a locks from `Expires()` / `IsStale()` and ensures an ongoing pruning
won't block `ValidateToken()`.

* Replace validator cache and pruning with `utils.FnCache`

This swaps the hand-rolled cache for validators with utils.FnCache,
since it's more robust and its TTL mechanism works properly for our
needs.

* Remove commented out test code

* Fix build errors and enable ReloadOnErr

* Code review suggestions

…60711)

* Add a caching OIDC validator for use with Kubernetes OIDC

This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
  library to cache internally. It currently has no internal method
  for invalidating old keys, so we purge the `oidc.KeySet` regularly.
  However, upon encountering an unknown `kid`, the library will
  attempt to fetch new keys on its own.

This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.

* Manage validator instances by issuer; use in Kubernetes validator

This adds an indirection layer to automatically manage validator
instances as cached data is specific to a particular (issuer,
audience) combination.

Additionally, this swaps the new caching validator in in place of the
standard non-caching validator.

* Fix comments and add missing mutex lock

* Add tests for the caching validator

* Fix lints

* Add logging

* Fix imports

* Code review suggestions: atomic expiry, misc fixes

This changes `validatorExpires` to be an atomic int64, which removes
a locks from `Expires()` / `IsStale()` and ensures an ongoing pruning
won't block `ValidateToken()`.

* Replace validator cache and pruning with `utils.FnCache`

This swaps the hand-rolled cache for validators with utils.FnCache,
since it's more robust and its TTL mechanism works properly for our
needs.

* Remove commented out test code

* Fix build errors and enable ReloadOnErr

* Code review suggestions

* Add a caching OIDC validator for use with Kubernetes OIDC

This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
  library to cache internally. It currently has no internal method
  for invalidating old keys, so we purge the `oidc.KeySet` regularly.
  However, upon encountering an unknown `kid`, the library will
  attempt to fetch new keys on its own.

This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.

* Manage validator instances by issuer; use in Kubernetes validator

This adds an indirection layer to automatically manage validator
instances as cached data is specific to a particular (issuer,
audience) combination.

Additionally, this swaps the new caching validator in in place of the
standard non-caching validator.

* Fix comments and add missing mutex lock

* Add tests for the caching validator

* Fix lints

* Add logging

* Fix imports

* Code review suggestions: atomic expiry, misc fixes

This changes `validatorExpires` to be an atomic int64, which removes
a locks from `Expires()` / `IsStale()` and ensures an ongoing pruning
won't block `ValidateToken()`.

* Replace validator cache and pruning with `utils.FnCache`

This swaps the hand-rolled cache for validators with utils.FnCache,
since it's more robust and its TTL mechanism works properly for our
needs.

* Remove commented out test code

* Fix build errors and enable ReloadOnErr

* Code review suggestions