Feature request: SRT: Support per-stream dynamic passphrase via Admission Webhook response

[Ed1ks]

Problem

OvenMediaEngine currently supports SRT encryption only via a globally
configured passphrase in Server.xml (SRTO_PASSPHRASE). This means all
SRT publishers connecting to the same OME instance share the same
pre-shared key.

For multi-tenant deployments with many independent publishers, this
creates a shared-secret problem: if one publisher's client is
compromised, the encryption key for all SRT streams on that OME
instance is exposed.

Current behavior

• SRT passphrase is static, defined in Server.xml
• All publishers share the same passphrase
• Admission Webhooks can authenticate publishers per-stream ✅
• But stream-level encryption remains global ❌

Desired behavior

Allow OME to apply a per-stream passphrase for SRT encryption,
provided dynamically by the Admission Webhook control server response.

Proposed approach: Extend the Admission Webhook response to include
an optional passphrase field:

{
  "allowed": true,
  "lifetime": 60000,
  "srt": {
    "passphrase": "<per-stream-key>",
    "pbkeylen": 16
  }
}****