test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

universal_cache_serialization_test.go

@@ -468,12 +468,12 @@ func TestMetadataCache_Issue116_Regression(t *testing.T) {
 	// Test: Store and retrieve metadata (the scenario from issue #116)
 	providerURL := "https://example.com"
 	metadata := &ProviderMetadata{
-		Issuer:         "https://example.com",
-		AuthURL:        "https://example.com/authorize",
-		TokenURL:       "https://example.com/token",
-		JWKSURL:        "https://example.com/jwks",
-		RevokeURL:      "https://example.com/revoke",
-		EndSessionURL:  "https://example.com/logout",
+		Issuer:          "https://example.com",
+		AuthURL:         "https://example.com/authorize",
+		TokenURL:        "https://example.com/token",
+		JWKSURL:         "https://example.com/jwks",
+		RevokeURL:       "https://example.com/revoke",
+		EndSessionURL:   "https://example.com/logout",
 		RegistrationURL: "https://example.com/register",
 		ScopesSupported: []string{"openid", "profile", "email"},
 	}