fix(ias): require verified provenance for IAS telemetry identity attributes

[tiagoek]

Summary

StarletteIASTelemetryMiddleware was calling parse_token() — a deliberately unverified JWT decoder — and promoting the decoded sap_gtid/user_uuid directly onto OTel span attributes (sap.tenancy.tenant_id, user.id). An attacker could forge a JWT carrying a victim tenant/user ID, submit it to any agent using this SDK, and permanently pollute telemetry attribution.

Root cause: no signature verification before stamping security-sensitive span attributes.

Fix (SDK-only — no consumer changes required):

1. New IASVerifier class — JWKS-backed verifier, auto-configured from the SAP BTP Identity service binding (VCAP_SERVICES on CF, IAS_URL env var on Kubernetes). Caches signing keys internally and handles key rotation transparently.
2. New VerifiedIASClaims frozen dataclass — the SDK's provenance marker. Instances can only come from a verifier that ran signature + issuer + algorithm + expiry checks.
3. StarletteIASTelemetryMiddleware now auto-configures IASVerifier.from_env() at construction and uses it to verify every token before stamping identity attributes. No consumer code changes needed.

Behaviour change

Scenario	Before	After
IAS service binding present (CF or K8s)	Unverified claims stamped	Verified-only claims stamped automatically
No IAS binding / env var	Unverified claims stamped	No identity attrs + WARNING logged; app starts normally
Forged JWT (attacker-signed)	Victim tenant_id/user.id stamped	Nothing stamped (verifier raises, attrs omitted)
x-sap-origin header	Always stamped	Always stamped (unchanged — not JWT identity)

Zero-config usage

from starlette.applications import Starlette
from sap_cloud_sdk.core.telemetry import auto_instrument
from sap_cloud_sdk.core.telemetry.middleware import StarletteIASTelemetryMiddleware

app = Starlette(...)
# Auto-configures IASVerifier from VCAP_SERVICES (CF) or IAS_URL (K8s)
auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)])

Agents that already have an IAS service binding get verified telemetry with zero code changes.

Apps without an IAS service binding

Identity span attributes will not be stamped and a WARNING is logged at startup — the app continues running normally. The previous behaviour (stamping unverified claims) was a security issue, so this is the correct safe default. Bind an SAP Identity service instance to restore them.

For advanced scenarios (e.g. Istio/Kyma already verified the token and double-verification is undesirable), a custom verifier can be passed via token_verifier=. See IAS user guide for details.

Scope

• SDK only. No consumer app changes.
• parse_token() is unchanged — still available as an unverified claim extractor (diagnostics, pre-auth inspection).
• AuditClient is unchanged — already requires explicit common.tenant_id; no auto-fill exists.
• cryptography>=44.0.0 promoted from dev-only to runtime dependency (required for RSA/EC key verification).

Files changed

File	Change
src/sap_cloud_sdk/ias/_verifier.py	NEW — IASVerifier + IASConfigError
src/sap_cloud_sdk/ias/_token.py	Added VerifiedIASClaims, TokenVerifier
src/sap_cloud_sdk/ias/__init__.py	Export IASVerifier, IASConfigError, VerifiedIASClaims, TokenVerifier
src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py	Auto-configure IASVerifier; identity attrs only on verified path
pyproject.toml	cryptography>=44.0.0 → runtime dep
tests/ias/unit/test_verifier.py	NEW — 22 tests for IASVerifier
tests/ias/unit/test_token.py	Added VerifiedIASClaims / TokenVerifier tests
tests/core/unit/telemetry/middleware/test_starlette_a2a.py	Full rewrite with auto-config + regression tests
src/sap_cloud_sdk/ias/user-guide.md	IASVerifier as primary approach
src/sap_cloud_sdk/core/telemetry/user-guide.md	Zero-config usage; token_verifier parameter docs

[tiagoek]

Superseded by #382 (clean branch: fix/ias-telemetry-verified-claims)