Migrate cargo handler to OIDCRegistry

[kbukum1]

What

Migrate the cargo registry handler from manual OIDC credential map + mutex to the shared OIDCRegistry type introduced in #78.

Why

Part of the phased migration to fix OIDC credential collisions when multiple registries share a host (#87). Cargo already used full URL keys, so this is a pure structural refactor with no behavior change.

What changes

• Replace oidcCredentials map[string]*oidc.OIDCCredential + sync.RWMutex with *oidc.OIDCRegistry
• Constructor uses oidcRegistry.Register() instead of manual CreateOIDCCredential + map insertion
• HandleRequest uses oidcRegistry.TryAuth() instead of TryAuthOIDCRequestWithPrefix()
• OIDC registration is guarded with if url != "" to preserve the original URL-scoped behavior and prevent host-only fallback from widening auth scope

All existing tests pass unchanged.

Behavior changes

• Credential selection is now deterministic. The old code iterated over a Go map (map[string]*OIDCCredential), so with multiple OIDC credentials on the same host, which one matched was nondeterministic. OIDCRegistry.TryAuth uses longest path-prefix matching, ensuring the most specific credential always wins. This is the core fix for OIDC credential collision when multiple registries share a host #87.

• Host matching uses strings.ToLower instead of IDNA normalization. The old TryAuthOIDCRequestWithPrefix used helpers.AreHostnamesEqual (IDNA ToASCII), while OIDCRegistry.TryAuth uses lowercase comparison. This is acceptable because all real OIDC registries (Azure DevOps, JFrog, AWS CodeArtifact, Cloudsmith) use ASCII hostnames — no package registry uses internationalized domain names.

[Copilot]

Pull request overview

Migrates the Cargo registry handler’s OIDC credential storage and request authentication from a per-handler map+mutex to the shared oidc.OIDCRegistry (added in #78), to avoid credential collisions and centralize OIDC handling.

Changes:

• Replace map[string]*oidc.OIDCCredential + sync.RWMutex with *oidc.OIDCRegistry in the Cargo handler.
• Use oidcRegistry.Register(...) during handler construction instead of manual CreateOIDCCredential + map insertion.
• Use oidcRegistry.TryAuth(req, ctx) during request handling instead of TryAuthOIDCRequestWithPrefix(...).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[AbhishekBhaskar]

LGTM