test: add unit tests for ScmIntegrationService, ScmTokenEncryptionService, and OidcAttestationService

[Copilot]

Three services lacked any test coverage: ScmIntegrationService (SCM integration CRUD), ScmTokenEncryptionService (AES-256-GCM token encryption), and OidcAttestationService (OIDC JWT attestation with JTI replay protection).

New test classes (17 tests total, no Spring context)

• ScmIntegrationServiceUnitTest — CRUD happy paths, ConflictException on duplicate provider, NotFoundException on missing integration; uses Mockito for the repository and a live ScmTokenEncryptionService instance.

• ScmTokenEncryptionServiceTest — encrypt→decrypt round-trip, IV randomness (two encryptions of the same plaintext must differ), short-key zero-padding, empty string, 10 000-char token, and rejection of invalid base64 ciphertext.

• OidcAttestationServiceTest — GitHub Actions and GitLab CI happy paths produce PASSED attestations; NotFoundException for unknown trail; IllegalArgumentException for untrusted issuer and missing iss claim; ConflictException on JTI replay.

@Test
fun `encrypt returns different value each call (IV randomness)`() {
    val first = service.encrypt("same-token")
    val second = service.encrypt("same-token")
    assertNotEquals(first, second)   // fresh 12-byte IV per encryption
}

@Test
fun `throws ConflictException when jti already used`() {
    whenever(jtiLogRepository.existsByJti("already-used-jti")).thenReturn(true)
    assertThrows(ConflictException::class.java) {
        service.recordOidcAttestation(OidcAttestationRequest(trailId, buildJwt(claims)))
    }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• invalid-confluence.example.com
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java /usr/lib/jvm/temurin-21-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/OpenFactstore/OpenFactstore/backend/build/tmp/test/work @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath11858267110009719177txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 4' (dns block)
• invalid-jira-url-that-does-not-exist.example.com
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java /usr/lib/jvm/temurin-21-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/OpenFactstore/OpenFactstore/backend/build/tmp/test/work @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath11858267110009719177txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 4' (dns block)
• invalid-jira.example.com
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java /usr/lib/jvm/temurin-21-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/OpenFactstore/OpenFactstore/backend/build/tmp/test/work @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath11858267110009719177txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 4' (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Copilot wasn't able to review any files in this pull request.