test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r152_test.go

@@ -0,0 +1,34 @@
+package traefikoidc
+
+import (
+	"testing"
+)
+
+// TestIsAllowedDomain_SubdomainGranted guards the R152 fix to
+// utilities.go isAllowedDomain: allowedUserDomains matched only the exact
+// whole domain, so a user on a corporate subdomain
+// ([email protected]) was silently denied even though the
+// operator's "company.com" intended to cover the org. A configured
+// domain now also grants its subdomains.
+func TestIsAllowedDomain_SubdomainGranted(t *testing.T) {
+	tObj := &TraefikOidc{
+		logger:             GetSingletonNoOpLogger(),
+		allowedUserDomains: map[string]struct{}{"company.com": {}},
+	}
+	if !tObj.isAllowedDomain("[email protected]") {
+		t.Fatal("a subdomain of an allowed domain must be granted")
+	}
+	if !tObj.isAllowedDomain("[email protected]") {
+		t.Fatal("a deep subdomain of an allowed domain must be granted")
+	}
+	// Exact match still works and unrelated domains still denied.
+	if !tObj.isAllowedDomain("[email protected]") {
+		t.Fatal("exact allowed domain must still be granted")
+	}
+	if tObj.isAllowedDomain("[email protected]") {
+		t.Fatal("a different domain sharing the suffix must NOT be granted")
+	}
+	if tObj.isAllowedDomain("[email protected]") {
+		t.Fatal("a domain merely ending in the allowed one must NOT be granted")
+	}
+}