feat: add client caching to reduce OAuth token requests

[spbsoluble]

Summary

• Introduces a ClientCache that caches Command API clients by configuration hash
• Reuses cached clients across reconciliations, allowing the underlying golang.org/x/oauth2 token caching to work as intended
• Reduces OAuth token endpoint calls from once-per-request to once-per-token-expiry

Problem

When using OAuth authentication, every certificate request reconciliation created a new Command API client. This meant:

1. A new clientcredentials.Config.TokenSource() was created each time
2. The token cache in the oauth2 library was thrown away with each new client
3. Every request triggered a new token fetch from the OAuth provider

For customers with OAuth provider quotas (common with enterprise IdPs), this caused rate limiting and quota exhaustion issues.

Solution

The fix introduces a ClientCache in internal/command/client_cache.go that:

• Caches clients by configuration hash: Uses SHA-256 hash of all config fields (hostname, credentials, scopes, etc.) as the cache key
• Thread-safe: Uses sync.RWMutex for safe concurrent access during reconciliations
• Shared across controllers: Both IssuerReconciler and CertificateRequestReconciler use the same cache instance
• Minimal code changes: Only cmd/main.go needed modification to create and inject the cache

Cache Key Design

The cache key includes all fields that affect the client connection:

• Hostname and API path
• CA certificates
• Basic auth credentials (if used)
• OAuth credentials, scopes, and audience (if used)
• Ambient credential configuration

This ensures:

• Different issuers get different clients
• Same issuer reuses its client across requests
• Credential rotation (via secret update) automatically gets a new client (different hash)

Test plan

• Added unit tests for configHash() function
• Added unit tests for ClientCache basic operations
• Verified build compiles successfully
• All existing tests continue to pass

Manual testing

To verify the fix works:

1. Deploy the updated controller
2. Monitor OAuth provider logs/metrics
3. Issue multiple certificates using the same issuer
4. Confirm only one token request is made (until token expires)

🤖 Generated with Claude Code