Release v2.44.0

Summary

AuthProxy can now sign the identity it forwards to each backend service with the Arc forwarded-identity envelope, so backends that verify signed identity accept requests only from their AuthProxy.

Added

• Optional per-service forwarded-identity signing (audience, key id and key) that signs proxied requests, bearer-route requests, identity-details calls and tenant-list calls with the Arc v1 envelope, after all request transforms (part of #139)
• Startup validation that refuses unusable signing settings and the same signing key shared between different backends, plus a startup report listing each identity-bearing flow and whether it is signed (part of #139)
• Aspire WithSignedForwardingTo(backend) that pairs AuthProxy with an Arc backend: a fresh key per backend for every local run, the matching verifier settings on the backend, and a required secret parameter for published deployments (#198)
• Documentation for configuring forwarded-identity signing and the Aspire pairing (part of #139)

Changed

• Inbound forwarded-identity envelope headers are removed before AuthProxy forwards a request, and a request is not sent when signing is configured but fails (part of #139)
• Bearer routes set the service header from the route's own service instead of passing a caller-supplied value through (part of #139)