Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(matchers)!: address topic-matcher spec-review findings

Remediates the verified findings from the spec-conformance review of the
topic-matcher work:

- Authorization error codes: a valid token that does not grant the action on
  the requested topic now yields 403 insufficient_scope (with a bare Bearer
  challenge) instead of 401, on the publish and subscription-API paths; 401
  stays for a missing or invalid token. JWT matcher-claim defects (unknown
  matcher type, invalid pattern, control characters) are now classified as
  invalid_token (401), never invalid_request (400), since they are defects of
  the presented token.
- Match cache poisoning: publish topics are validated (control characters,
  invalid UTF-8) before they can reach the shared match cache via canDispatch,
  so a topic containing a NUL can no longer collide with a legitimate
  multi-topic cache key.
- Information disclosure: an uncompilable URL Pattern in a subscribe query
  parameter no longer echoes the go-urlpattern error (which can embed a live
  heap pointer) to the client; a generic message is returned and the detail is
  logged.
- Subscription API authorization is performed against the absolute path
  (r.URL.EscapedPath()) rather than the full RequestURI, so a token presented
  via the query parameter no longer breaks byte-for-byte Exact matching.
- Matcher objects in JWT claims lacking the required "match" property (or JSON
  null) invalidate the token instead of being silently accepted as an
  empty-pattern matcher.
- Base URL immutability: TopicSelectorStore rejects a conflicting base URL when
  shared across hubs with different public URLs, and scopes its match and
  compiled-pattern caches by base, so a shared store can no longer serve a
  result computed under the wrong base.
- Subscribe-time payload resolution short-circuits when no subscribe claim
  carries a per-matcher payload, avoiding up to matchers×claims URL Pattern
  evaluations per request.

Also exports the... (continued)