fix(workload-identity): allow-list issuer enums, label SPIFFE preview

[lakhansamani]

Follow-up to the review that produced #774–#776, from the question "is SPIFFE
shipped as preview?".

It says preview in exactly one place — a Go comment

internal/constants/grant_types.go:31 reads "PREVIEW: the underlying draft
expired 2026-01-02 and is not WG-adopted. This URN is not IANA-registered and may
change. Ship as experimental only."

Nothing user-facing repeated that. README listed SPIFFE JWT-SVID with a ✅
alongside GA features — while already using a "beta" caveat for the Vue and
Svelte SDKs, so the convention existed and simply wasn't applied. Now labelled.

The part that was more than a docs gap

key_source_type and issuer_type were validated for non-emptiness only.
spiffe_bundle_endpoint is a declared constant with no implementation —
fetchJWKSBytes has no case for it and falls through to unsupported key_source_type — so an operator could create a trusted issuer, get a 200 and a
row that looked configured, and find out it was dead only when the first workload
tried to authenticate. A typo (static_jwks_urls) failed the same way at the
same unhelpful moment.

Both fields are now allow-listed, spiffe_bundle_endpoint refused by name
with "not implemented yet" rather than a generic invalid — those call for
different actions.

Nothing breaks

• The dashboard offered spiffe_bundle_endpoint in its dropdown
  (UpdateTrustedIssuerModal.tsx:23-25). Left alone, this PR would have made the
  UI present an option guaranteed to error. Removed there too; the two lists are
  now the same list.
• Existing rows are unaffected. Validation is write-time only,
  UpdateTrustedIssuerRequest cannot set either field, and the read path is
  untouched. A row already holding spiffe_bundle_endpoint was already broken
  and stays exactly as broken — no upgrade cliff.
• Every value the Kubernetes path uses (oidc_discovery, static_jwks_url,
  kubernetes_sa) is allow-listed, and the existing gRPC/GraphQL trusted-issuer
  tests pass unchanged.

Dead code removed

AuthMethodX509MTLS ("x509_mtls", Phase 6): nothing read it, AddTrustedIssuer
hardcoded jwt_assertion, and no request field could set it — unreachable in
every direction. Removed rather than left as a claim the code does not honour.
AddTrustedIssuer now uses constants.AuthMethodJWTAssertion instead of a bare
literal, which is what made that constant look unused too.

KeySourceSPIFFEBundleEndpoint is deliberately kept — the new validator
rejects it by name, so the constant now has a job.

Verification

Both allow-list tests confirmed failing with the validator reverted.

go build ./...   OK
go vet ./...     OK
make test        exit 0 — 43 packages, 0 FAIL
make lint        exit 0  (Go + Prettier on both web apps)
make smoke       exit 0

Separately — a bigger finding, not fixed here

While checking this wouldn't break Kubernetes deployments I found that
in-cluster TokenReview cannot work at all, and the code says so at
client_assertion.go:492: SafeHTTPClient refuses private IPs, so
https://kubernetes.default.svc is unreachable — while performTokenReview
reads Authorizer's in-cluster SA token (/var/run/secrets/...) to authenticate
to it. The two assumptions contradict, and README lists Kubernetes TokenReview
as shipped with no caveat. Writing that up separately with a kind-based test.