tests: Harden runtime authorization, JWT rotation, and magic tokens

[nishantmonu51]

Add fail-closed authorization coverage and harden token boundaries.

• include template variables and resource kinds in authorization cache identity
• prevent shared claim/rule mutation during concurrent resolution
• validate built-in report, alert, and canvas authorization matrices
• fail closed for malformed protected resources
• refresh rotated JWKS keys safely while retaining the last valid key set
• validate JWT issuer and audience and honor cancellation during initial fetch
• enforce magic-token resource boundaries through a real admin-to-runtime handoff
• add a narrow embedded-runtime fixture for integration assertions

Validation:

• go test -short -race -count=1 ./runtime -run '^Test(ResolveSecurity|BuiltIn)'
• go test -short -race -count=1 ./runtime/server/auth
• go test -short -race -count=1 ./admin/server -run '^TestMagicAuthTokenAuthorizationBoundary$'

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. No documentation update is required.
• Intend to cherry-pick into the release branch
• I am proud of this work!

[nishantmonu51]

Temporarily closing to keep the first review wave focused. We will reopen this PR after #9730, #9731, and #9732 have merged. The branch is being retained.