Lint: fix real int-truncation bug; document intentional gosec findings

- TransportPool configKey: write conn-count ints verbatim (strconv) instead of
  byte() truncation — a config value >=256 previously truncated and made two
  distinct configs collide on one key, silently sharing a transport with the
  wrong settings (real fix, gosec G115).
- Document design-intentional gosec findings with //nolint:gosec + rationale:
  G117 (clients_secret intentionally marshaled into stored creds JSON),
  G704 (tokenURL is the trusted discovery endpoint), G124 (delete/test cookie,
  Secure set conditionally), G118 (long-lived background refresh) and pool
  utils short-ID rune, testutil mock server redirects.

Result: full-tree golangci-lint now reports 0 issues (was ~12). Build, vet,
and the full test suite remain green.

internal/testutil/servers/oidc.go

@@ -279,7 +279,7 @@ func (s *OIDCServer) handleAuthorize(w http.ResponseWriter, r *http.Request) {
 	}
 
 	redirectURL := fmt.Sprintf("%s?code=test-auth-code&state=%s", redirectURI, state)
-	http.Redirect(w, r, redirectURL, http.StatusFound)
+	http.Redirect(w, r, redirectURL, http.StatusFound) //nolint:gosec // mock IdP redirects to its configured (trusted) endpoint
 }
 
 func (s *OIDCServer) handleUserinfo(w http.ResponseWriter, r *http.Request) {
@@ -342,7 +342,7 @@ func (s *OIDCServer) handleLogout(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "invalid post_logout_redirect_uri", http.StatusBadRequest)
 			return
 		}
-		http.Redirect(w, r, postLogoutRedirect, http.StatusFound)
+		http.Redirect(w, r, postLogoutRedirect, http.StatusFound) //nolint:gosec // mock IdP post-logout redirect
 		return
 	}