Add awsSts auth type support to vMCP

[tgrunnagle]

Summary

MCPServerEntry resources using type: awsSts failed to deploy through vMCP with "unsupported auth type: awsSts" because the vMCP auth converter registry had no converter registered for this type, even though AWSStsConfig was fully specified in the CRD. This PR closes that gap by implementing the full vMCP-side AWS STS auth path: a converter, an outgoing auth strategy, and the plumbing to wire them into the existing registry and factory.

• The AwsStsConverter in pkg/vmcp/auth/converters/ maps CRD AWSStsConfig fields to the internal AwsStsConfig type and is registered in NewRegistry(). ResolveSecrets is a no-op because AWS STS credentials are obtained at runtime via IRSA or the pod's instance profile.
• The AwsStsStrategy in pkg/vmcp/auth/strategies/ handles outgoing request authentication: it extracts the bearer token, selects the IAM role via CEL-based claim matching, calls AssumeRoleWithWebIdentity, and signs the request with SigV4. A per-config cache (keyed by SHA-256 over all config fields) avoids redundant STS client construction across requests.
• pkg/auth/awssts.RequestSigner is exported (previously unexported) so the vMCP strategy can sign requests outside the HTTP middleware flow.
• Config validation in pkg/vmcp/config/validator.go and the YAML loader now explicitly handle aws_sts, and pkg/vmcp/auth/types/types.go gains the AwsStsConfig and RoleMapping types with deep-copy generated code.

Closes #5018

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Unit tests cover:

• AwsStsConverter: nil config, valid conversion with and without role mappings, ResolveSecrets no-op behavior.
• AwsStsStrategy: Validate (missing config, missing region, valid), Authenticate (health check skip, nil config, missing identity, missing claims, full success path), and cache key stability across concurrent callers.
• registry_test.go: verifies awsSts is now a registered converter type.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
pkg/vmcp/auth/converters/aws_sts.go	New: AwsStsConverter — maps CRD AWSStsConfig to BackendAuthStrategy
pkg/vmcp/auth/converters/aws_sts_test.go	New: unit tests for AwsStsConverter
pkg/vmcp/auth/converters/interface.go	Register AwsStsConverter in NewRegistry()
pkg/vmcp/auth/converters/registry_test.go	Verify awsSts converter is registered
pkg/vmcp/auth/strategies/aws_sts.go	New: AwsStsStrategy — STS token exchange and SigV4 signing
pkg/vmcp/auth/strategies/aws_sts_test.go	New: unit tests for AwsStsStrategy
pkg/vmcp/auth/factory/outgoing.go	Register AwsStsStrategy in NewOutgoingAuthRegistry()
pkg/vmcp/auth/types/types.go	Add AwsStsConfig, RoleMapping types and StrategyTypeAwsSts constant
pkg/vmcp/auth/types/zz_generated.deepcopy.go	Generated deep-copy for new types
pkg/vmcp/config/validator.go	Validate aws_sts strategy fields (region required)
pkg/vmcp/config/yaml_loader.go	Handle aws_sts in processBackendAuthStrategy
pkg/auth/awssts/signer.go	Export RequestSigner and add NewRequestSigner constructor
pkg/auth/awssts/middleware.go	Minor: update newRequestSigner call sites for exported type
pkg/auth/awssts/middleware_test.go	Update test references for exported type
docs/operator/crd-api.md	Updated CRD API docs

Does this introduce a user-facing change?

Yes. MCPServerEntry resources with type: awsSts in their MCPExternalAuthConfig can now be deployed through vMCP. Previously they failed immediately at startup with an "unsupported auth type" error.

Special notes for reviewers

The AwsStsStrategy maintains a per-config cache of roleMapper and exchanger instances using double-checked locking. The cache key is a SHA-256 hash over all config fields (region, service, fallback ARN, role mappings sorted by ARN, role claim, session name claim) to avoid structural ambiguity from colons in ARN strings. The cache exists to avoid rebuilding the AWS SDK STS client on every request; the SDK performs TLS handshake and credential chain resolution on construction, which are non-trivial.

The RequestSigner type in pkg/auth/awssts is exported to allow AwsStsStrategy to sign requests directly rather than going through the HTTP middleware. The newRequestSigner internal constructor is retained so the middleware can continue using withService options without exposing those option types.

Generated with Claude Code

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

[codecov]

Codecov Report

❌ Patch coverage is 53.24675% with 108 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.95%. Comparing base (cffe934) to head (337be8c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/vmcp/auth/strategies/aws_sts.go	47.85%	76 Missing and 9 partials ⚠️
pkg/vmcp/config/validator.go	12.50%	7 Missing ⚠️
pkg/vmcp/config/yaml_loader.go	0.00%	7 Missing ⚠️
pkg/auth/awssts/signer.go	45.45%	6 Missing ⚠️
pkg/vmcp/auth/factory/outgoing.go	57.14%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5019      +/-   ##
==========================================
- Coverage   69.02%   68.95%   -0.08%     
==========================================
  Files         554      556       +2     
  Lines       73075    73305     +230     
==========================================
+ Hits        50443    50548     +105     
- Misses      19620    19736     +116     
- Partials     3012     3021       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.