Fix unbounded server-controlled retry sleep on HTTP 429 (OKTA-1235975)

[prachi-okta]

Summary

OKTA-1235975: the SDK's 429 retry delay was computed entirely from the server-supplied x-rate-limit-reset header with no upper bound, so a malicious or MitM server could force the client thread to sleep indefinitely. Since this sleep can happen inside OAuth2ClientCredentials.applyToParams (synchronized), one blocked call could stall every other caller waiting on token refresh — a client-side DoS triggerable by untrusted response data.

• RetryUtil.get429DelayMillis now clamps the computed delay to a maxDelayMillis ceiling.
• OktaHttpRequestRetryStrategy derives that ceiling from retryMaxElapsed if explicitly configured, otherwise falls back to the same 20s cap already used for 503/504/IOException retries — so 429 is no longer the exception.
• DefaultClientBuilder now actually wires clientConfig.getRetryMaxElapsed() into the strategy (previously set on ClientConfiguration but never read anywhere — dead config).
• README updated to document the new default cap and the existing requestTimeout/setRetryMaxElapsed escape hatch for anyone who needs a longer wait.

Separately (own commit, unrelated root cause): bumps httpclient5 5.6.2 → 5.6.4 to resolve CVE-2026-64607 (connection-leak DoS in the classic I/O model on malformed Content-Encoding headers), found while chasing an unrelated stalled release:prepare run. This supersedes the existing dependabot/maven/.../httpclient5-5.6.3 branch.

Test plan

• RetryUtilTest: normal/legitimate reset value unaffected; simulated malicious 429 (reset ~1 year out) clamps to the ceiling; Long.MAX_VALUE header-overflow attempt still bounded; cap wins over the MIN_RETRY_DELAY_MS floor; expired reset timestamp falls back to the minimum.
• OktaHttpRequestRetryStrategyTest (new): end-to-end getRetryInterval() against a malicious 429 response — default config caps at 20s, explicit retryMaxElapsed=5 caps at 5s, non-429 exponential backoff unaffected.
• DefaultClientBuilderTest.groovy (new tests): reflects into the real HttpClientBuilder.retryStrategy built by createHttpClientBuilder to prove the production wiring (not just the isolated strategy) bounds the malicious delay.
• Full suite: 174/174 impl tests + 56/56 api tests passing.
• mvn dependency:tree confirms httpclient5:5.6.4 is what's actually resolved into the build.

---

AI Attribution: ai-agent-authored