[WIP] feat: implement OAuth client secret rotation

[IlonaShishov]

Summary

Implements automatic OAuth client secret rotation for redhat-sso-client-secret and gma-client-secret using Google Secret
Manager's native rotation features.

What's Included

Infrastructure:

• Deployment script to configure Secret Manager rotation schedules and Pub/Sub notifications
• Rotation periods configurable via environment (default: 1 hour for testing)
• Cleanup and documentation updates

Rotation Endpoint:

• POST /rotation endpoint integrated with marketplace handler
• Pub/Sub OIDC token verification for transport security
• Provider registry pattern for routing secrets to appropriate APIs
• Comprehensive error handling and structured audit logging
• ~1700 lines of code, 27 tests passing

Architecture:

• SecretValueProvider ABC with template method pattern
• Inherited validation (32+ bytes, 10+ unique chars)
• RedHatSSOSecretProvider for Red Hat Identity API integration
• GMASecretProvider for Google Marketplace Admin API integration
• SecretProviderRegistry routes secrets to providers

How It Works

1. Secret Manager triggers event when next_rotation_time is reached
2. Pub/Sub pushes notification to /rotation endpoint with OIDC JWT
3. Endpoint validates Pub/Sub token and routes to appropriate provider
4. Provider fetches new secret from upstream API (Red Hat Identity or GMA)
5. Provider validates secret quality
6. New version stored in Secret Manager
7. Completion logged with structured event types

Testing

All rotation tests passing (27 tests):

• Event parsing and workflow logic
• Provider validation and template methods
• Pub/Sub JWT verification
• Endpoint authentication and error handling
• Integration with marketplace handler

Deployment

See deploy/cloudrun/README.md for:

• Running setup-secret-rotation.sh
• Configuring Pub/Sub push endpoint
• Monitoring rotation events
• Testing instructions

[IlonaShishov]

Credential providers do not support automated secret rotation, closing for now, implementing manual policy instead #181