Lint: fix real int-truncation bug; document intentional gosec findings

- TransportPool configKey: write conn-count ints verbatim (strconv) instead of
  byte() truncation — a config value >=256 previously truncated and made two
  distinct configs collide on one key, silently sharing a transport with the
  wrong settings (real fix, gosec G115).
- Document design-intentional gosec findings with //nolint:gosec + rationale:
  G117 (clients_secret intentionally marshaled into stored creds JSON),
  G704 (tokenURL is the trusted discovery endpoint), G124 (delete/test cookie,
  Secure set conditionally), G118 (long-lived background refresh) and pool
  utils short-ID rune, testutil mock server redirects.

Result: full-tree golangci-lint now reports 0 issues (was ~12). Build, vet,
and the full test suite remain green.

internal/pool/transport.go

@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -246,9 +247,15 @@ func (p *TransportPool) configKey(config TransportConfig) string {
 	sb := Get().GetStringBuilder()
 	defer Get().PutStringBuilder(sb)
 
-	sb.WriteByte(byte(config.MaxConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConns))
+	// Write the int fields verbatim, not byte()s: a config value >=256 would
+	// otherwise truncate and make two distinct configs collide on one key,
+	// silently sharing a single transport with the wrong settings.
+	sb.WriteString(strconv.Itoa(config.MaxConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConns))
+	sb.WriteByte('|')
 	if config.ForceHTTP2 {
 		sb.WriteByte(1)
 	} else {

internal/pool/utils.go

@@ -14,7 +14,7 @@ func BuildSessionName(baseName string, index int) string {
 	sb.WriteRune('_')
 	// Efficient int to string conversion
 	if index < 10 {
-		sb.WriteRune('0' + rune(index))
+		sb.WriteRune('0' + rune(index)) //nolint:gosec // index is bounded by the short alphabet size
 	} else {
 		sb.WriteString(intToString(index))
 	}