feat(jwt-exp): exp claim at the access entry level

[matheuscscp]

Closes: #3755

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.60%. Comparing base (063014a) to head (ba3dee1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3761   +/-   ##
=======================================
  Coverage   91.60%   91.60%           
=======================================
  Files         189      189           
  Lines       26930    26932    +2     
=======================================
+ Hits        24670    24672    +2     
  Misses       1460     1460           
  Partials      800      800           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR implements fine-grained JWT access entry expiration, allowing individual resource access entries within a JWT bearer token to have their own expiration times. This addresses issue #3755 and enables use cases like enterprise licenses where different products/repositories can have different expiration times within the same token.

Changes:

• Added optional ExpiresAt field to ResourceAccess struct in the bearer authentication system
• Implemented expiration validation logic that skips expired access entries while allowing valid ones
• Added comprehensive test coverage for the new per-entry expiration feature

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/api/bearer.go	Added optional ExpiresAt field to ResourceAccess struct and implemented expiration check in authorization logic
pkg/api/bearer_test.go	Added comprehensive test cases covering future expiration, past expiration, mixed expired/valid entries, and all-expired scenarios

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[matheuscscp]

@andaaron Should I rebase this one?

[andaaron]

@andaaron Should I rebase this one?

yes.

[matheuscscp]

On it!