core: reject a JWK entry missing x5c when loading a SPIFFE trust bundle

[TimurRakhmatullin86]

SpiffeUtil.extractCert silently truncates a SPIFFE trust bundle when a JWK keys[] entry is
missing x5c:

for (Map<String, ?> keyNode : keysNode) {
  checkJwkEntry(keyNode, trustDomainName);
  List<String> rawCerts = JsonUtil.getListOfStrings(keyNode, "x5c");
  if (rawCerts == null) {
    break;          // abandons the loop, dropping every remaining cert
  }
  if (rawCerts.size() != 1) {
    throw new IllegalArgumentException(...);   // sibling paths throw
  }
  ...
}

checkJwkEntry has already guaranteed the entry is a declared x509-svid key (use == "x509-svid",
kty in {RSA, EC}), so an entry with no x5c is malformed. But instead of failing, the break
abandons the loop and returns only the certificates collected before the bad entry — so a
trust domain whose keys array has a missing-x5c entry ahead of valid ones loads a silently
truncated trust store, and peers whose chain roots in a dropped CA fail verification (or a
partially loaded store is accepted with no error).

This also contradicts the method's own contract (loadTrustBundleFromFile javadoc: "If any
element of the JSON content is invalid or unsupported, an IllegalArgumentException is thrown and
the entire Bundle is considered invalid"). Every other malformed condition in extractCert
(use, kty, kid, x5c.size() != 1, unparseable cert) throws.

Fix: throw IllegalArgumentException for a missing x5c, consistent with the sibling error
paths and the documented contract, instead of silently dropping certificates.

Tests: added spiffebundle_missing_x5c.json and an assertion in
SpiffeUtilTest.loadTrustBundleFromFileFailureTest. It fails against the current code (the old
break returns a truncated bundle without throwing) and passes with the fix. :grpc-core
checkstyle/animalsniffer clean.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: TimurRakhmatullin86 / name: Timur Rakhmatullin (66d4fbf)

[shivaspeaks]

Please sign the EasyCLA if you want us to review.