test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r60_claims_mem_test.go

@@ -19,7 +19,7 @@ func TestExtractGroupsRolesSingleString(t *testing.T) {
 	}
 
 	groups, roles, err := oidc.extractGroupsAndRolesFromClaims(map[string]interface{}{
-		"groups": "domain_users",          // single string
+		"groups": "domain_users",         // single string
 		"roles":  []interface{}{"admin"}, // array form still works
 	})
 	if err != nil {