feat(oidc): enforce strict transport defaults

[danifronter]

What changed

• Enforces TLS verification, bounded timeouts and no redirect following for discovery, token and JWKS calls.
• Adds safe correlation-ID propagation for OIDC backchannel requests.
• Rejects non-HTTPS discovered OIDC endpoints.

Why

Consumers need a verifiable transport boundary before production OIDC adoption.

Validation

• composer test
• composer analyse
• composer audit --no-interaction
• composer validate --strict
• git diff --check

Release

This remains a draft. After review, publish a semantic v1.2.0 tag and update each consumer lock file in its own reviewed PR.

[danifronter]

Superseded by #5, which completed the reviewed Identity SDK 2.0 transport and DPoP work and was released as v2.0.0. Closing this earlier draft to keep one authoritative upgrade path.