test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r193_fuzz_test.go

@@ -0,0 +1,26 @@
+package traefikoidc
+
+import "testing"
+
+// FuzzParseJWTFuzz verifies parseJWT (used on attacker-controlled cookies /
+// bearer tokens) never panics on arbitrary input — no slice OOB, no
+// unbounded alloc, no JSON-engine surprise. It must return an error or a
+// valid JWT, never panic (R193).
+func FuzzParseJWTFuzz(f *testing.F) {
+	seeds := []string{
+		"",
+		".",
+		"a.b.c",
+		"...",
+		"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsifQ.eyJzdWIiOiJ4In0.sig", // valid header+claims
+		"$$$.$$$.$$$",
+		"a\u202e.\nb.\t",
+		"%%%",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+	f.Fuzz(func(t *testing.T, token string) {
+		_, _ = parseJWT(token) // must not panic
+	})
+}