feat(oidc): release workload identity SDK 1.2

[danifronter]

What changed

• Adds confidential workload client-credentials issuance.
• Hardens RS256 workload token validation for issuer, audience, client, authorized party, scope, temporal claims, tenant binding and workload status.
• Adds bounded clock skew, JWKS caching and safe key rotation.
• Adds optional client-side private_key_jwt support without claiming Identity server support.
• Adds 1.2.0 changelog, upgrade notes, compatibility matrix and release checklist.

Why

ORBIT Enterprise Agents require a stable, reviewable workload identity contract before replacing temporary branch aliases in ORBIT and Enix Platform.

Validation

• PHPUnit: 21 tests, 76 assertions.
• PHPStan: passing.
• composer validate --strict: passing.
• composer audit --locked: no advisories.

Deployment note

private_key_jwt must remain disabled until Identity explicitly provisions and confirms it. Existing client_secret_post integrations remain compatible.