fix(dpop): cache key pair to drop per-request keychain lookup and lock

[sfdctaka]

Summary

DPoPKeyStore.keyPair(forScope:) performed a Keychain lookup (SecItemCopyMatching) and acquired a global exclusive barrier lock on every DPoP proof build (resource + token endpoint). Under DPoP, that serialized all DPoP-bound requests behind uncached securityd round-trips.

This adds a process-local key-pair cache keyed by credential scope:

• Warm path — served via a non-barrier concurrent read: no Keychain I/O, no exclusive lock.
• Cold path — the .barrier is taken only to load-or-generate the key pair once, double-checked so concurrent cold callers converge on a single mint.
• Delete — evicts the cached entry (inside the same barrier) before removing the persistent key, so a later fetch regenerates.
• hasKeyPair(forScope:) short-circuits on a cache hit.

Key material, proof format, claims, and header-attachment behavior are unchanged; signing still occurs independently for every request (the proof's jti/iat and its ECDSA signature vary per request by design). No public API change; no feature flag (straight revert to roll back).

iOS counterpart to Android #3045.

Verification

• New unit tests in SFSDKDPoPTests: warm-hit object identity, concurrent convergence (via concurrentPerform, single-mint), delete eviction, in-memory-clear reloads the same persistent key, and a hasKeyPair cache-first regression test (persisted key removed out of band, cache still reports present until cleared).
• SalesforceSDKCoreTests full scheme passing (iPhone 16, iOS 18.6).
• docs/auth/token-lifecycle.md updated to document the cache and eviction-on-delete.

[github-actions]

	Tests	Passed	Skipped	Failed ❌️
AuthFlowTester UI Test Results all	1 ran			1 ❌

Test	Result
AuthFlowTester UI Test Results all
AuthFlowTesterUITests.xctest
LegacyLoginTests.testCAOpaque_DefaultScopes_WebServerFlow()	❌ failure

[codecov]

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 67.81%. Comparing base (90028da) to head (822df13).
⚠️ Report is 2 commits behind head on dev.

Files with missing lines	Patch %	Lines
...forceSDKCore/Classes/OAuth/DPoP/DPoPKeyStore.swift	94.11%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #4178      +/-   ##
==========================================
- Coverage   71.73%   67.81%   -3.92%     
==========================================
  Files         254      254              
  Lines       23027    23040      +13     
==========================================
- Hits        16518    15625     -893     
- Misses       6509     7415     +906     

Components	Coverage Δ
Analytics	70.78% <ø> (ø)
Common	71.20% <ø> (ø)
Core	61.70% <94.11%> (-5.86%)	⬇️
SmartStore	73.45% <ø> (ø)
MobileSync	88.84% <ø> (ø)

Files with missing lines	Coverage Δ
...forceSDKCore/Classes/OAuth/DPoP/DPoPKeyStore.swift	81.96% <94.11%> (+2.80%)	⬆️

... and 31 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wmathurin]

One PR-description correction: “proofs and headers are byte-identical” is not accurate because DPoP proofs intentionally vary through jti, iat, and the ECDSA signature. Could we replace it with something like: “Key material, proof format, claims, and header-attachment behavior are unchanged; signing still occurs independently for every request.”

[github-actions]

	Tests	Passed ✅	Skipped	Failed
SalesforceSDKCore iOS ^18 Test Results	1050 ran	1050 ✅

Test	Result
No test annotations available