feat: [Destinations] Support Zero Trust Identity Service

[MatKuhr]

Context

SAP/cloud-sdk-java-backlog#376.

This PR introduces support for the Zero Trust Identity Service and the related credential type X509_ATTESTED in IAS service bindings.

API Design

• Dedicated Module
  • (+) Can be referenced by connectivity-oauth or other potentially modules as <optional> dependency
  • (+) Using <optional> means no new dedicated public API / class-loading is needed
  • (+) Doesn't come in by default, so doesn't "pollute" the dependency tree of apps that don't need it
  • (+) We can include the linux-specific dependency as users who need this module will almost definitely need it
  • (-) It may be tempting for future developers to simply add this dependency in other places of the SDK, without the optional tag
    • I tried adding an enforcer rule but the enforcer plugin does not seem capable enough to cover this. I tried using banTransitiveDependencies but that wasn't working (at all, really, it bans any transitive dependency and configuring it not to is at a pain at best, I can't get it to work reliably)
• KeyStore ZeroTrustIdentityService.getInstance().getOrCreateKeyStore()
  • (+) Easy to use
  • (+) Doesn't require Spiffe library in public API
  • (-) It's hard for the user to know when the KeyStore will expire
• Fallback to file system for local testing by customizing the service binding
  • (+) Based on fixed properties -> SDK doesn't have to do any guessing / fallback
  • (-) Properties are completely "made up", users have to mock the binding locally
  • (-) Mocking bindings locally is super clunky

E2E Test PR: link
Successful E2E test run: link.
Documentation: PR

Feature scope:

• Load certificates via SPIFFE workload API
• Fallback to file system access for local testing
• Integration into OAuth flows with credential type X509_ATTESTED

Definition of Done

• Functionality scope stated & covered
• Tests cover the scope above
• Error handling created / updated & covered by the tests above
• Documentation updated
• Release notes updated

[newtork]

Looks LGTM to me.