fix incorrect return value from ensureOIDCProvider

[travisbcotton]

Description

In internal/vault/client_vault.go, ensureOIDCProvider wrote the base issuer to Vault (correct — Vault requires scheme+host with no path), but then compared Vault's read-back against cfg.IssuerURL directly. Since Vault appends /v1/identity/oidc/provider/openchami to form the effective issuer, the operator flagged a provider it had just created as a conflict on the next reconcile.

Notably, the existing tests hid the bug because their mock Vault returned the base issuer on read-back instead of the effective issuer that real Vault returns.

Changes

internal/vault/client_vault.go

• Added expectedOIDCProviderIssuer(base string) helper that appends the provider path to the trimmed base (matches the suggested fix and the existing vaultOIDCProviderPathSuffix in helpers.go).
• ensureOIDCProvider still writes the base issuer to Vault, but now compares both the pre-write read and the post-write read-back against the effective expected issuer. Conflict errors now report the effective issuer on both sides.
• Updated the doc comments to explain the write-base / compare-effective distinction and reference issue [Bug]: Vault OIDC provider issuer comparison uses base issuer instead of effective provider issuer #62.

internal/vault/client_vault_test.go

• Fixed the three existing tests to have the mock Vault return the realistic effective issuer (base + provider path) on read-back.
• Added four regression tests per the issue:
  • TestExpectedOIDCProviderIssuer — unit test for the helper (incl. trailing-slash trimming).
  • TestVaultClient_EnsureOIDCProviderIdempotentOnEffectiveIssuer — the core case: an operator-created provider read back as the effective issuer is accepted, not a conflict.
  • TestVaultClient_EnsureOIDCProviderRealConflict — a genuine cross-Vault host mismatch is still an OIDCIssuerConflictError with no write.
  • TestVaultClient_EnsureOIDCProviderCreateReconcileReconcile — create → reconcile → reconcile all succeed.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.