[#1130] Verify client assertions by their own alg; default id_token_signed_response_alg

[vharseko]

Fixes #1130 — both correctness bugs reported there, in OpenAMClientRegistration.

Bug 2 — client assertions were dispatched on id_token_signed_response_alg

verifyJwtIdentity() chose HMAC vs. asymmetric verification from the client's id_token_signed_response_alg — the algorithm of the ID tokens we issue — so a private_key_jwt client whose ID-token algorithm was HS256 had its RS256 assertion pushed through the shared-secret verifier (JwsSigningException: Unsupported Signing Algorithm, SHA256withRSA).

The method has four callers: two verify client-signed assertions (ClientCredentialsReader, JwtBearerGrantTypeHandler), two verify OpenAM-issued ID tokens (IdTokenInfo, OpenIdConnectSSOProvider). Dispatching on token_endpoint_auth_method as the issue suggests would break the latter two and legacy clients that never set the method. Instead the dispatch now follows the JWS header of the presented JWT: HMAC → client secret only; anything else → the client's registered public keys only (jwks / jwks_uri / x509); none → refused. No alg-confusion is possible because neither branch can reach the other's key material. OpenAM-issued ID tokens are unaffected: their header matches the configured algorithm. A client without a secret (public client) now gets false for an HMAC assertion instead of an NPE in the resolver.

Bug 1 — NPE when id_token_signed_response_alg was never persisted

AgentsRepo.getAgentAttrs() reads agent attributes with getAttributesWithoutDefaults(), so the schema default (HS256 in AgentService.xml) is not applied; a client created via the realm-config REST endpoint or ssoadm without that attribute made getIDTokenSignedResponseAlgorithm() return null, which NPE'd in StatefulTokenStore.createOpenIDToken (toUpperCase()), IdTokenInfo and the old verifyJwtIdentity (JwsAlgorithm.valueOf(null)). It now falls back to HS256 — the default the schema, the console and dynamic registration (ID_TOKEN_SIGNED_RESPONSE_ALG_DEFAULT) already use, rather than the spec's RS256, to stay consistent with clients created through the console.

Tests

OpenAMClientRegistrationTest +4: default (empty set / null / explicit value); HS256 assertion verified with the secret under idTokenSignedResponseAlg=RS256 and rejected with a wrong secret; RS256 assertion verified against the client's JWKS under HS256 and rejected with a foreign key; alg=none refused. Full openam-oauth2 suite passes (877 test methods).