fix(client): fix SPIFFE X509-SVID retry logic for timing issues

[tkircsi]

Fixes "certificate contains no URI SAN" errors in dirctl workloads (especially CronJobs) caused by SPIRE agent-server sync delays.

Changes:
Move duplicate retry logic from client and server packages into a shared
utils/spiffe package. Make retry parameters configurable via constructor
to allow faster unit tests. Move retry tests to utils/spiffe/retry_test.go
for better code organization.

• Create utils/spiffe/retry.go with shared X509SourceWithRetry wrapper
• Update client/options.go to use shared implementation
• Update server/authn/service.go to use shared implementation
• Move retry tests from client/options_test.go to utils/spiffe/retry_test.go
• Fix linter errors (if-else chains, error wrapping)

The retry logic handles cases where SPIRE entries haven't synced to the agent yet, which is common with short-lived workloads.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / verify-proto (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	⏩ skipped	✅ passed	Dec 1, 2025, 12:35 PM

[Copilot]

Pull request overview

This PR fixes "certificate contains no URI SAN" errors in dirctl workloads by consolidating duplicate retry logic into a shared utils/spiffe package with configurable retry parameters.

Key changes:

• New shared retry implementation in utils/spiffe package with configurable backoff parameters
• Wrapper type X509SourceWithRetry that applies retry logic during TLS handshakes
• Comprehensive test coverage for retry scenarios including zero ID, nil SVID, and exponential backoff

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
utils/spiffe/retry.go	New shared retry implementation with X509SourceWithRetry wrapper and GetX509SVIDWithRetry function
utils/spiffe/retry_test.go	Comprehensive test coverage for all retry scenarios with fast test-specific parameters
client/options.go	Migrated to shared retry implementation and X509SourceWithRetry wrapper
server/authn/service.go	Migrated to shared retry implementation for both JWT and X509 modes
utils/go.mod	Added go-spiffe/v2 and testify dependencies to utils module

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 21.08844% with 116 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
server/authn/service.go	0.0%	54 Missing ⚠️
utils/spiffe/retry.go	48.4%	30 Missing and 2 partials ⚠️
client/options.go	3.2%	30 Missing ⚠️

📢 Thoughts on this report? Let us know!