Add Nexus secure credential propagation sample

[bergundy]

What changed?

Adds core/src/main/java/io/temporal/samples/nexussecurecredentialpropagation, a sample that propagates an end-user JWT from a client, through a caller Workflow, to a Nexus Operation handler without the JWT appearing in plaintext in history, Temporal headers, or Nexus headers.

• Receiver-encrypted headers. The credential travels only in headers, encrypted with Tink HPKE to the receiving hop (caller Worker for the start hop, Nexus handler for the Nexus hop). Clients and caller Workers hold only public keys for the hops they send on.
• Bound to the exact arguments. Each header's HPKE context binds it to the hop's context and to a SHA-256 digest of the transmitted argument ciphertexts, their positions, and count. No input is canonicalized or re-serialized. The payload codec hands the digest to the interceptors through a thread local and knows nothing about credentials.
• Continue-as-new headers are bound to firstExecutionRunId (the Java SDK builds that header before encoding arguments). Child Workflows never receive the credential.
• Handler. Takes the route from the actual Nexus request, validates the JWT, authorizes the input against the principal and a client-sealed intent (which bounds what signals/updates can steer the Workflow into), derives the backing Workflow ID from principal + business identity, and signs operation tokens so they can't be forged for cancellation.
• Codec. Context-bound Tink AEAD payloads; rejections are non-retryable PayloadValidationError so the handler reports BAD_REQUEST instead of retrying.
• Adds com.google.crypto.tink:tink:1.23.0 to core.

The README documents the threat model, wire formats, key distribution, replay cases, steering alternatives, and the access-layer boundary for replayed cancels.

Why?

To show a replay-safe way to carry end-user identity across a Nexus call where neither history readers nor holders of sender-side keys can read or repurpose the credential.

Breaking changes?

None.

Testing

• SecureCredentialPropagationTest (20 end-to-end tests against the test server): start / signal-with-start / update-with-start, continue-as-new to another type plus retry, child Workflows, cancellation, argument reorder/duplicate/truncate/substitute, copied continue-as-new header, key-less attacker replaying captured Nexus input and headers (exact replay, input swap, endpoint move, missing credential), intent and subject checks, wrong audience, and a misordered interceptor.
• CryptoComponentsTest (18 unit tests): framing, header contexts and parsing, args digest, codec context binding, JWT validation, intent policy, resource IDs, operation tokens.
• Full :core:test passes.
• Ran the three-process demo against a local dev server (Server 1.32) and verified neither history contains the JWT, its claims, or business values.