X509 Certificate Validation - x5t Thumbprint

[nenaraab]

Provides Certificate Thumbprint (x5t) validator which becomes part of a set of proof of possession validators.

1. Prerequisite: the token must provide a cnf claim with x5t#S256 member.
   
   Example:

   "cnf": {
     "x5t#S256": "2blWiJDH07q0b2qEwShOIxtt10CkZ5xdDw4Vbs8ddoI"
   }

2. For that validation step a SHA-256 thumbprint of the client certificate RFC 8705 needs to be created.
3. To check whether my application is a legit target for this SHA-256 thumbprint needs to match with the cnf token claim.
4. Furthermore it provides a auth.ClientCertificateFromCtx(request) to get a x509.Certificate if provided within the x-forwarded-client-cert header.
5. It supports DER and PEM formatted certificates.
6. Instead of middleware.Authenticate use AuthenticateWithProofOfPossession, which returns

• instead of two parameters: token and err
• three parameters, namely token, *x509.Certificate and err

[liga-oz]

Just a few remarks to consider, overall looking good 👍🏻

[f-blass]

I like your table tests 👍

Added however some remarks and questions.

[liga-oz]

approved 😄 I hope you checked the fwd-cert header format coming from k8s

[f-blass]

LGTM!

I have just a few comments mainly in speeding up the tests.

[f-blass]

Based on the PR from Jakob yesterday. Does it make sense to cache this cert or do you actually need new certs each test run? Maybe the key can also be shortened to 512 bits.