[creds]: Accept ECDSA server certs in preferredCipherSuites

[parinmaru2]

Summary

Add TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 to preferredCipherSuites in internal/transport/creds/tls.go.

Until now preferredCipherSuites listed only ECDHE_RSA variants, so TLS.Validate() — via UsesSecureCertificateAlgorithm(preferredCipherSuites...) in internal/transport/creds/validation.go — rejected any server credential whose leaf uses an ECDSA key with:

key type "ecdsa" incompatible with allowed cipher suites

That's a real deployment blocker for identity systems that issue ECDSA leaves by default. Adding the two ECDHE_ECDSA_AES_GCM suites is the minimum change to accept ECDSA leaves without loosening any other property of the negotiated session:

• Still ECDHE (forward secrecy).
• Still AES-GCM (authenticated encryption).
• Still TLS 1.2 minimum; TLS 1.3 negotiation is unchanged (Go doesn't let this field control it).
• No new key exchanges (no static-RSA, no CBC, no ChaCha20 additions).

So this widens the set of acceptable leaf key types on the server side without widening the negotiation surface.

Test plan

• go test ./internal/transport/creds/... — passes locally.
• Updated the existing TestTLS_Validate subtest for ECDSA:
  renamed "ECDSA cert rejected by RSA-only cipher suites" → "ECDSA cert accepted", replaced the require.ErrorContains(err, "key type") assertion with require.NoError(...).
• Dropped a now-inaccurate // preferredCipherSuites are RSA-only comment on the RSA-cert subtest.
• go vet ./internal/transport/creds/... clean.

Notes for reviewers

• No production code paths changed besides the cipher-suite slice literal.
• HasSufficientKeySize in internal/transport/creds/validation.go already accepted ECDSA keys (min 256-bit curve) — that path was reachable but only via a non-empty allowedSuites set that included at least one ECDSA suite, which is why it hadn't been triggered by prior tests.
• MTLS.Validate() also feeds preferredCipherSuites into UsesSecureCertificateAlgorithm (see internal/transport/creds/mtls.go), so mTLS server-side validation gets the same fix for free.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.95%. Comparing base (9264c19) to head (0c87af0).
⚠️ Report is 42 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #92      +/-   ##
==========================================
+ Coverage   85.60%   87.95%   +2.34%     
==========================================
  Files          33       63      +30     
  Lines        1042     2723    +1681     
==========================================
+ Hits          892     2395    +1503     
- Misses        128      250     +122     
- Partials       22       78      +56     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[pseudomuto]

Hey @parinmaru2, thanks for the PR!

Adding ECDSA is a straight win IMO, and this LGTM 👍 Once you sign the CLA, I'll get this merged.