feat: Wire built-in plugins into pipeline and listeners

[huang195]

Summary

• Introduces authlib/plugins/ package with jwt-validation and token-exchange plugins that delegate to auth.HandleInbound/HandleOutbound
• Rewires all four listeners (ext_proc, ext_authz, forward-proxy, reverse-proxy) to execute through pipeline.Pipeline instead of calling *auth.Auth directly
• Adds pipeline: YAML config section for plugin composition with programmatic fallback defaults
• Supports waypoint audience derivation via WithAudienceDeriver functional option

Details

This is PR 2 of the plugin architecture series. PR 1 (merged in #358) added the pipeline package with types and runner. This PR proves the architecture works by wrapping existing auth logic as plugins -- behavior is identical, just executed through the pipeline path.

New files:

• authlib/plugins/jwtvalidation.go -- inbound JWT validation plugin
• authlib/plugins/tokenexchange.go -- outbound token exchange plugin
• authlib/plugins/registry.go -- name-to-factory registry + Build() constructor
• authlib/plugins/defaults.go -- default/waypoint pipeline constructors
• authlib/plugins/plugins_test.go -- 13 unit tests

Modified files:

• All four listener/*/server.go -- accept *pipeline.Pipeline instead of *auth.Auth
• cmd/authbridge/main.go -- builds pipelines from config, passes to listeners
• authlib/config/config.go -- adds PipelineConfig struct

Test plan

• authlib/plugins tests pass (13/13)
• cmd/authbridge/listener/extproc tests pass
• cmd/authbridge/listener/extauthz tests pass
• cmd/authbridge/listener/forwardproxy tests pass
• cmd/authbridge/listener/reverseproxy tests pass
• go vet ./... clean
• Existing behavior unchanged (same allow/deny/replace-token responses)

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[esnible]

I reviewed this manually and found no problems. I disagreed with most of the review skill's comments, but this one makes sense:

  #: 1                                                                                                                                          
  File: authbridge/cmd/authbridge/listener/extauthz/server.go, extproc/server.go, forwardproxy/server.go                                        
  Line: multiple                                                                                                                                
  Severity: suggestion                                                                                                                          
  Comment: extractBearer is duplicated identically in 3 packages. Consider extracting it to a shared internal/ or authlib/ helper to avoid drift
    between copies. 

[huang195]

@esnible thanks for the review. Regarding your comment:

It's a valid observation but I'd leave it. The function is 4 lines, trivial, and unlikely to drift. Extracting it to a shared package would mean either:

  1. Importing authlib/auth from the listeners just for this one helper (adds a dependency that the refactor specifically removed)
  2. Creating a new internal/ or authlib/httputil package for a single 4-line function

  Both add more complexity than they remove. If it grows or gets a bug fix, that's the time to consolidate. Three identical 4-line functions is fine.