Security hardening and additional test coverage

[rhuss]

Summary

Security and test quality findings from multi-agent code review. All Minor severity, no immediate risk.

Security Observations

1. WithExtraHeaders can override authorization (auth_extra.go:56-74): Extra headers take precedence over base auth headers on key collision. Consider warning when security-critical headers are overridden.

2. Token refresh fallback doesn't distinguish transient vs terminal errors (auth_refresh.go:90-98): Stale token fallback after refresh failure doesn't distinguish network errors from revocation (401/403). Consider different handling for terminal errors.

3. InsecureSkipVerify + CAFile is contradictory (internal/grpc/conn.go:67-71): When both are set, the CA is loaded but has no effect. Warn or error on this combination.

4. SSHSession.Token visible via JSON marshal (types/ssh.go:30-34): String() redacts the token but JSON serialization and structured loggers bypass it. Consider MarshalJSON redaction.

5. NoAuth default is silent (client.go:68-69): Nil auth silently defaults to NoAuth(). Consider requiring explicit auth or logging a warning.

Test Coverage Gaps

1. TLS error paths untested (internal/grpc/conn.go:67-96): Missing tests for CA file read failure, invalid PEM, and CertFile/KeyFile mismatch.

2. IsUnimplemented/IsUnauthenticated untested (errors.go): Public API helpers without test coverage.

3. ListProviders weak assertions (sandbox_client_test.go:435-448): Only checks Len(result, 2), not field values.

4. Nil token source paths untested (auth_refresh.go:101-109): Defensive code for TokenSource.Token() returning (nil, nil) has no test.

Minor Architecture Items

1. Dead code: CopyByteSlice (converter/copy.go:42-51): Exported but never called.
2. Duplicate package doc comment (grpc_errors.go:4-6): Competes with doc.go.
3. Trivial deny-rule wrappers (converter/network_policy.go:286-292): l7QueryMapFromProtoDeny/l7QueryMapToProtoDeny add indirection with no logic.
4. Test-only ToProto converters exported (converter/sandbox.go, converter/policy.go): Could move to _test.go files.

Source

Multi-agent code review (Security, Test Quality, Architecture agents), PR NVIDIA/OpenShell#2271