Policy: KAS registration lacks validation of URI

[jakedoublev]

Background

Registering a KAS to a platform currently requires a unique URI and a public_key that is either remote or cached:

platform/service/policy/kasregistry/key_access_server_registry.proto

Line 22 in 0551247

message CreateKeyAccessServerRequest {

Soon, it will also include (optionally) a common name for the KAS which is also unique: #153

However, the uri field in the proto above has no validation at present.

./otdfctl policy kasr create -r https://remote.com/kas -u 'b' --json
{
  "id": "87859c4d-b7f2-4366-8900-658b2a97de49",
  "uri": "b", // this should not be valid
  "public_key": {
    "PublicKey": {
      "Remote": "https://remote.com/kas"
    }
  },
  "metadata": {
    "created_at": {
      "seconds": 1728938163,
      "nanos": 43877000
    },
    "updated_at": {
      "seconds": 1728938163,
      "nanos": 43877000
    }
  }
}

Acceptance Criteria

1. define allowed protocol schemes for KAS URIs
2. enforce valid URI format with a CEL expression at the proto level