Add optional ID-JAG encryption with JWE

[mcguinness]

Summary

Adds an optional ## Encrypted ID-JAG mechanism that lets an IdP Authorization Server JWE-encrypt the ID-JAG to its target Resource Authorization Server, mirroring how OpenID Connect ID Tokens can be encrypted.

Motivation

The claims an End-User has consented to release to a Client during SSO are not necessarily the same as the claims the IdP Authorization Server is permitted to release to the audience of an ID-JAG. An ID-JAG may carry sensitive attributes (email, phone_number, sub_id, audience-scoped enterprise identifiers, etc.) that the Client should not be able to read but that the Resource Authorization Server needs for subject resolution and policy. Encryption preserves this distinction by ensuring only the RAS can decrypt the JWS.

What's in the PR

• New section ## Encrypted ID-JAG {#id-jag-encryption} under # Identity Assertion JWT Authorization Grant defining the JWE structure (outer header MUST carry alg, enc, cty: JWT, kid; SHOULD carry typ: oauth-id-jag+jwt), sign-then-encrypt as REQUIRED, IdP-side issuer processing, RAS-side consumer processing, and a non-normative example.
• IdP Authorization Server Metadata: id_jag_encryption_alg_values_supported and id_jag_encryption_enc_values_supported to advertise capability, with negotiation rule (intersection with RAS values).
• Resource Authorization Server Metadata: same parameter names used as a request (when paired with a use: enc key in jwks_uri), plus id_jag_encryption_required for deployments that mandate encryption.
• Access Token Request Processing Rules: new decrypt-first bullet so the existing typ/aud/client_id/signature checks all run against the inner JWS.
• DPoP cnf self-check reconciliation: the client SHOULD only inspect the ID-JAG for cnf when it is not encrypted. Explicit note that this is a loss of a client-side diagnostic, not a weakening of PoP, since the RAS still enforces cnf after decryption.
• Security Considerations: extended ## Subject Identifier Disclosure to point at encryption as the mitigation when downstream-required identifiers cannot be omitted, plus a new ## Claim Confidentiality {#id-jag-claim-confidentiality} consideration.
• Normative references: RFC 7516 (JWE), RFC 7517 (JWK), RFC 7518 (JWA).
• IANA: registers the three new metadata parameters in the OAuth Authorization Server Metadata registry.

Test plan

• Render with kramdown-rfc / xml2rfc and confirm cross-references resolve ({{id-jag-encryption}}, {{ras-metadata}}, {{token-request}}, {{id-jag-claim-confidentiality}}).
• Confirm the non-normative example renders correctly as preformatted text.
• Confirm RFC 7516, 7517, 7518 references resolve in the bibliography.
• Confirm no existing anchors changed.

[panva]

Requiring enc is incompatible with JOSE HPKE https://datatracker.ietf.org/doc/html/draft-ietf-jose-hpke-encrypt-20 where only alg is present for the Integrated Encryption mode.

[mcguinness]

Good catch, thanks. Pushed 878ae99 to address this.

The fix loosens the JWE header rules so that enc is required only when the chosen alg uses a separate content encryption algorithm (the JWE Key Encryption mode case), and prohibited when the chosen alg is an Integrated Encryption mode such as the HPKE algorithms defined in draft-ietf-jose-hpke-encrypt.

Specifically:

• JWE Structure: alg, cty, kid stay MUST. enc is now scoped to "MUST be present when the chosen alg is a Key Encryption mode (or other mode that uses a separate content encryption algorithm)" and "MUST NOT be present when the chosen alg is an Integrated Encryption mode that prohibits enc, for example the HPKE Integrated Encryption algorithms."
• IdP issuer processing step 2: encrypts using one of the advertised alg values, and selects an enc value only when the chosen alg requires one. Otherwise omits enc.
• Negotiation rule: pick alg from the intersection first, then enc from the corresponding intersection only when the chosen alg requires it.
• Metadata: id_jag_encryption_enc_values_supported MAY be omitted (on both the IdP and RAS sides) when only Integrated Encryption modes are supported. id_jag_encryption_alg_values_supported + a use: enc JWK in the JWK Set is now the standalone signal to encrypt.
• Dropped the "key wrap" framing in the alg and kid descriptions so that Direct Encryption and Integrated modes aren't implicitly excluded.

Added draft-ietf-jose-hpke-encrypt as an informative reference.