test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r142_test.go

@@ -0,0 +1,22 @@
+package traefikoidc
+
+import "testing"
+
+// TestReplayCacheKey_NamespacedByIssuer verifies JTI replay entries are
+// keyed by issuer (not a bare jti), so tokens issued by different OIDC
+// providers sharing the process-global replay cache never collide (R142).
+func TestReplayCacheKey_NamespacedByIssuer(t *testing.T) {
+	if replayCacheKey("https://issuer-a.example.com", "jti-1") == replayCacheKey("https://issuer-b.example.com", "jti-1") {
+		t.Fatal("same jti from different issuers must not share a replay key")
+	}
+	// Same issuer + jti is stable (idempotent) for the gate to work.
+	k1 := replayCacheKey("issuer", "jti")
+	k2 := replayCacheKey("issuer", "jti")
+	if k1 != k2 {
+		t.Fatal("same issuer+jti must be stable")
+	}
+	// Different jti under the same issuer must differ.
+	if replayCacheKey("issuer", "jti-1") == replayCacheKey("issuer", "jti-2") {
+		t.Fatal("different jti under the same issuer must differ")
+	}
+}