test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

url_helpers_ultra_test.go

@@ -620,7 +620,7 @@ func TestBuildAuthURLGuaranteesOpenIDScope(t *testing.T) {
 	t.Run("openid omitted from scopes_supported but other scopes kept", func(t *testing.T) {
 		m := createMinimalMiddleware()
 		m.providerURL = "https://provider.example.com"
-		m.scopes = []string{"email", "profile"} // no openid configured
+		m.scopes = []string{"email", "profile"}          // no openid configured
 		m.scopesSupported = []string{"email", "profile"} // provider omits openid
 		m.scopeFilter = NewScopeFilter(newNoOpLogger())