DGS-24778 Pass context when clients make KEK calls to DEK Registry

[Robert Yokota (rayokota)]

What

Checklist

• Contains customer facing changes? Including API/behavior changes
• Did you add sufficient unit test and/or integration test coverage for this PR?
  • If not, please explain why it is not required

References

JIRA:

Test & Review

Open questions / Follow-ups

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull request overview

This PR ensures Schema Registry context (parsed from context-qualified subjects like ":.myctx:subject") is propagated to DEK Registry KEK operations, so KEKs are retrieved/registered within the correct context rather than defaulting silently.

Changes:

• Parse context from RuleContext.subject in the encryption executor and include it in KEK lookup/creation.
• Extend DEK Registry client and mock client KEK APIs/caching to be context-aware (new optional context parameter, context included in KekId cache key).
• Add a unit test validating context-qualified vs default-context KEK behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/schema_registry/test_encrypt_executor.py	Adds coverage to ensure KEK operations use the context parsed from the subject.
src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py	Extracts context from subject and threads it through KEK get/register calls.
src/confluent_kafka/schema_registry/rules/encryption/dek_registry/mock_dek_registry_client.py	Updates mock DEK registry client to support context-aware KEK caching and retrieval.
src/confluent_kafka/schema_registry/rules/encryption/dek_registry/dek_registry_client.py	Adds context to KEK APIs and cache keys; passes context to DEK Registry endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqube-confluent]

Quality Gate failed

Failed conditions
58.6% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube