feat(diameter): provide origin-scoped End-to-End identifier authority

[VerifiedOrganic]

Summary

The Diameter APIs accept caller-supplied raw u32 End-to-End Identifiers, but the SDK does not expose a reusable origin-scoped allocator or recent-identifier fence. Each consumer must therefore invent identifier generation and retention around every request family, which can silently violate duplicate-detection uniqueness under concurrency or restart.

Verified on signed SDK main at e1743a1ba0146b9afa93a99633c7cd97a3d9a8da. SwmDiameterTransaction::new accepts a raw Hop-by-Hop and End-to-End pair, and typed DER, STR, ASR, RAR, and AAR builders consume that transaction without owning identifier allocation.

Public source:

openpacketcore-sdk/crates/opc-proto-diameter/src/apps/swm.rs

Lines 878 to 892 in e1743a1

	pub struct SwmDiameterTransaction {
	hop_by_hop_identifier: u32,
	end_to_end_identifier: u32,
	}
	impl SwmDiameterTransaction {
	/// Construct the identifiers assigned to one outbound Diameter request.
	pub const fn new(hop_by_hop_identifier: u32, end_to_end_identifier: u32) -> Self {
	Self {
	hop_by_hop_identifier,
	end_to_end_identifier,
	}
	}
	fn from_message(message: &Message<'_>) -> Self {

Standards requirement

RFC 6733 section 3 requires an originator to keep End-to-End Identifiers locally unique for at least four minutes, retain the same value across retransmission, and avoid reuse after restart using the specified time-derived restart technique or an equivalent uniqueness authority.

https://www.rfc-editor.org/rfc/rfc6733.html#section-3

Required change

• Add a bounded origin-scoped DiameterEndToEndIdentifierAuthority suitable for every Diameter application, not only SWm.
• Allocate identifiers atomically under concurrency and retain a four-minute recent-use fence with an injectable monotonic clock for tests.
• Model exhaustion and clock failure explicitly; never fall back to an unchecked random u32.
• Provide restart-safe initialization consistent with RFC 6733 and document the persistence or time assumptions.
• Return an affine request identity that can be retained unchanged across same-request retries and failover attempts.
• Keep identifiers, origin host values, request bytes, and application identities out of diagnostics and metrics.

Acceptance criteria

• Deterministic tests cover concurrent allocation, wraparound, full bounded-window exhaustion, expiry after four minutes, backward clock movement, restart within and beyond the protected window, and retry-stable reuse of one affine identity.
• At least 65,536 concurrent/recent allocations contain no duplicate, including forced RNG collisions if randomness contributes entropy.
• SWm DER, STR, ASR, RAR, and AAR composition examples consume the authority rather than independent ad hoc generators.
• The public API cannot accidentally mint a second End-to-End Identifier for retransmission of the same request.
• All tables and work are bounded and use no sensitive values in Debug, errors, traces, or metrics.

Non-goals

• Hop-by-Hop allocation, which remains connection-local.
• Peer selection, request failover policy, or durable application-session ownership.
• Logging or persisting subscriber/application payloads.

Related: #349 covers pending-request failover and must preserve the identifier allocated by this authority.