Security: per-organisation OIDC discovery, JWKS and token clients bypass the egress guard #1096

What is wrong

#1088 routed every tenant-directed outbound dial in the host (callable sources, crawler, object store, webhooks and the Slack notifier through webhooks) through the shared classifier auth.IsPublicDestinationDialAddress / auth.IsPublicDestination. Three outbound clients remain unguarded:

• OIDC discovery: module/services/accounts/code/pkg/.../oidc/discovery.go:65 uses a plain http.Client, reached from identity_provider_builder.go:50.
• JWKS fetch: oidc/validator.go:111 uses http.DefaultClient.
• Token exchange: oidc/exchanger.go:56 uses a plain http.Client.

They fetch the per-organisation identity provider's issuer, JWKS and token URLs. Those URLs come from rows saved by ConfigureOrgIdentityProvider (business/identity_providers.go:95-145) with no validation.

Why it is latent, not live

Nothing exposes ConfigureOrgIdentityProvider through an RPC today, so a tenant cannot set those URLs. The day a write path is exposed, an organisation admin could point discovery at 169.254.169.254, 100.100.100.200 or an internal service.

Ask

Before any write path is exposed:

• route all three clients through the same guarded dialer fix(accounts): every host egress guard refuses every non-global address (#1086) #1088 introduced, with no proxy and the guard re-run on every connection and redirect;
• validate the issuer, JWKS and token URLs when they are saved;
• test both, with one case per Security: callable-source egress guard admits CGNAT, NAT64/6to4/Teredo and other non-global ranges (SSRF) #1086 range, using a recording dial hook so no test can reach a real address.

Then remove the OIDC exception that #1089 adds to the egress docs.