Drop unusable JWKS placeholders before go-jose

[rdimitrov]

Summary

• After the jwx v4 migration, unparseable JWKS entries are kept as UnsupportedKey placeholders whose original JSON round-trips losslessly. bridgeJWKSet fed that JSON to go-jose, which either failed the whole set on an unknown kty or accepted RSA keys below jwx's 2048-bit floor.
• Token exchange now drops those placeholders before the conversion, so mixed JWKS documents keep their usable keys and weak RSA is rejected on the same path as TokenValidator.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test) — go test -race ./pkg/authserver/server/tokenexchange (package suite, including TestBridgeJWKSet_DropsUnsupportedKeys)
• E2E tests (task test-e2e)
• Linting (task lint-fix) — skipped; local golangci-lint cannot typecheck against Go 1.27.1
• Manual testing (describe below)

Does this introduce a user-facing change?

Yes. External issuers whose JWKS mixes understood keys with unknown key types can now complete token exchange using the usable keys. Tokens signed with RSA keys smaller than 2048 bits are rejected on the token-exchange path (they already failed OIDC middleware verification after #6626).

Special notes for reviewers

This is the follow-up to #6626. TokenValidator was already fail-closed (jwk.Export refuses placeholders); only the go-jose bridge on MultiIssuerTokenValidator needed the filter.

Made with Cursor

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 79.24%. Comparing base (a31832b) to head (f5c0e87).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
...ver/server/tokenexchange/multi_issuer_validator.go	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6697      +/-   ##
==========================================
- Coverage   79.24%   79.24%   -0.01%     
==========================================
  Files         795      795              
  Lines       80380    80386       +6     
==========================================
+ Hits        63699    63701       +2     
- Misses      16676    16680       +4     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.