Migrate terraform handler to OIDCRegistry

[kbukum1]

What

Migrate the Terraform registry handler from manual OIDC credential map + mutex to the shared OIDCRegistry type introduced in #78.

Why

Part of the phased migration to fix OIDC credential collisions when multiple registries share a host (#87).

Terraform was storing OIDC credentials keyed by hostname only via cred.Host(). The OIDCRegistry now preserves the full URL (via url field, with cred.Host() fallback), fixing potential collisions.

Behavior changes

• Credential selection is now deterministic. The old code iterated over a Go map (map[string]*OIDCCredential), so with multiple OIDC credentials on the same host, which one matched was nondeterministic. OIDCRegistry.TryAuth uses longest path-prefix matching, ensuring the most specific credential always wins. This is the core fix for OIDC credential collision when multiple registries share a host #87.

• Host matching uses strings.ToLower instead of IDNA normalization. The old TryAuthOIDCRequestWithPrefix used helpers.AreHostnamesEqual (IDNA ToASCII), while OIDCRegistry.TryAuth uses lowercase comparison. This is acceptable because all real OIDC registries (Azure DevOps, JFrog, AWS CodeArtifact, Cloudsmith) use ASCII hostnames — no package registry uses internationalized domain names.

[Copilot]

Pull request overview

Migrates the Terraform registry handler to use the shared oidc.OIDCRegistry so OIDC credentials can be matched collision-free (host bucket + longest path-prefix match), aligning Terraform with the registry-wide OIDC credential storage approach introduced in #78 / fixing #87 scenarios.

Changes:

• Replaced Terraform’s per-handler OIDC credential map + RWMutex with oidc.OIDCRegistry.
• Updated Terraform OIDC registration to use the credential’s url field as the primary key (preserving path), with host fallback.
• Adjusted OIDC handling tests to expect Terraform registration logs to include the full URL key.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/handlers/terraform_registry.go	Switches Terraform OIDC auth to OIDCRegistry and removes handler-level mutex/map storage.
internal/handlers/oidc_handling_test.go	Updates expected Terraform OIDC registration log lines to match new URL-based keys.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[AbhishekBhaskar]

Just left a follow up comment for Copilot's comment.

[kbukum1]

Just left a follow up comment for Copilot's comment.

Yes the comment is valid. It explains why OIDC creds continue (skip static credential processing)