security: fix #167-#172 — credential isolation, path traversal, TLS verification, token leakage

[mjudeikis-bot]

Fixes #167, #168, #169, #170, #171, #172

Changes

• security: shared admin transport used for all user proxy requests — zero per-user credential isolation #167: kcp impersonation headers in OIDC + static-token proxy — per-user RBAC instead of shared admin transport
• security: unverified JWT clusterName used in URL path construction — path traversal risk #168: validate JWT clusterName with regex before URL path use — prevents path traversal
• security: agent SA bearer token blindly injected for all tunneled requests — no per-user scoping in downstream cluster #169: document agent-SA privilege level for all tunneled k8s requests
• security: static tokens bypass SubjectAccessReview for edges proxy — access to all edges with no RBAC check #170: remove static token SAR bypass in edges proxy — all tokens go through authorizeFn
• security: InsecureSkipTLSVerify hardcoded in auto-generated agent kubeconfig #171: populate hub CA in agent kubeconfigs — no more unconditional InsecureSkipTLSVerify in production
• security: user OIDC token forwarded to agent in upgrade path (exec/port-forward) — unnecessary credential leakage #172: strip Authorization before forwarding upgrade requests to edge agent — no user token leakage

[mjudeikis-bot]

Reviewed all 6 files. Security fixes look correct:

• agent.go: CA data + Insecure=true conflict fixed correctly.
• tunnel/server.go: Agent-SA privilege level docs are good. Impersonation callout noted.
• rbac_reconciler.go: hubCAData/devMode split is right approach. Minor: ServingCertFile read won't pick up cert rotations but acceptable for one-time kubeconfig generation.
• proxy.go: Path traversal regex ^[a-z0-9]+(?:[:-][a-z0-9]+)*$ correct for kcp cluster names. Impersonation headers fix the shared-admin-creds issue.
• edges_proxy_builder.go: Condition rewrite is cleaner and semantically equivalent. Authorization strip on upgrade requests is correct.

LGTM from Hex review. Ready to merge once CI passes.