fix(pop-spring): bind request content, single-source htu authority

- PopAuthenticationFilter hands CallerVerifier a bounded ContentSource, so
  the request body is read once, on the verifier's demand after the SCITT
  binding (ANS-6 §7.4 step 12), and is then replayed to the handler
  through a request wrapper. Content above the bound (Builder
  withMaxContentBytes, default 1 MiB) is rejected with 413 before it is
  hashed. Previously the filter never supplied content, so every proof
  that carried ans_content_digest was rejected and body-bearing requests
  were accepted with the body unbound.
- The trusted-authority check reads the same URL the proof's htu is
  compared against instead of the raw Host header (§7.7), so forwarded
  header processing can no longer make the two diverge. The
  withTrustedHosts Javadoc now says that behind a TLS-terminating proxy
  the container's URL is the proxy hop, and withExternalUrl or trusted
  forwarded-header handling is required.
- Builder gains withVerifier(CallerVerifier), mutually exclusive with
  withPoPSkew, and withRootKeyRefresher(RootKeyRefresher). The example
  wires the refresher to TransparencyClient.refreshRootKeysIfNeeded.

Addresses the review on PR #108.

Assisted-by: Claude Code (claude-fable-5-1)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: kperry <kperry@godaddy.com>

Author: kperry-godaddy

ans-sdk-pop-spring/examples/dpop-scitt-auth/src/main/java/com/godaddy/ans/examples/dpopscittauth/PopSecurityConfig.java

@@ -4,14 +4,17 @@
 import com.godaddy.ans.sdk.pop.ReplayCache;
 import com.godaddy.ans.sdk.pop.spring.PopAuthenticationFilter;
 import com.godaddy.ans.sdk.transparency.TransparencyClient;
+import com.godaddy.ans.sdk.transparency.scitt.RefreshDecision;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.ApplicationRunner;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
 import java.security.PublicKey;
+import java.time.Instant;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Supplier;
 
@@ -49,10 +52,19 @@ public FilterRegistrationBean<PopAuthenticationFilter> popAuthenticationFilter(
         PopAuthenticationFilter filter = PopAuthenticationFilter
             .builder(expectedIssuer, rootKeys, replayCache)
             .withTrustedHosts(trustedHost)
+            .withRootKeyRefresher(artifactIssuedAt -> refreshRootKeys(transparencyClient, artifactIssuedAt))
             .build();
 
         FilterRegistrationBean<PopAuthenticationFilter> registration = new FilterRegistrationBean<>(filter);
         registration.addUrlPatterns("/*");
         return registration;
     }
+
+    private static Optional<Map<String, PublicKey>> refreshRootKeys(TransparencyClient client,
+                                                                    Instant artifactIssuedAt) {
+        RefreshDecision decision = client.refreshRootKeysIfNeeded(artifactIssuedAt)
+            .orTimeout(2, TimeUnit.SECONDS)
+            .join();
+        return decision.isRefreshed() ? Optional.of(decision.keys()) : Optional.empty();
+    }
 }