Auth: Signing Key persistence (#75487)

* signing key wip

use db keyset storage

add signing_key table

add testing for key storage

add ES256 key tests

Remove caching and implement UpdateOrCreate

Stabilize interfaces

* Encrypt private keys

* Fixup signer

* Fixup ext_jwt

* Add GetOrCreatePrivate with automatic key rotation

* use GetOrCreate for ext_jwt

* use GetOrCreate in id

* catch invalid block type

* fix broken test

* remove key generator

* reduce public interface of signing service

pkg/services/authn/clients/ext_jwt.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-jose/go-jose/v3"
 	"github.com/go-jose/go-jose/v3/jwt"
 	"golang.org/x/exp/slices"
 
@@ -172,7 +173,13 @@ func (s *ExtendedJWT) verifyRFC9068Token(ctx context.Context, rawToken string) (
 	}
 
 	var claims ExtendedJWTClaims
-	err = parsedToken.Claims(s.signingKeys.GetServerPublicKey(), &claims)
+	_, key, err := s.signingKeys.GetOrCreatePrivateKey(ctx,
+		signingkeys.ServerPrivateKeyID, jose.ES256)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get public key: %w", err)
+	}
+
+	err = parsedToken.Claims(key.Public(), &claims)
 	if err != nil {
 		return nil, fmt.Errorf("failed to verify the signature: %w", err)
 	}