feat(signer): support EdDSA for the local token signer

[somaz94]

Overview

Adds EdDSA (Ed25519) as a signing algorithm for the local token signer, completing #4442. The local signer already supported RS256 and ES256, so this fills in the remaining algorithm requested in the issue.

What this PR does / why we need it

EdDSA produces much smaller signatures than RS256, which matters for setups with a tight token-size budget — the issue describes Argo CD storing tokens as cookies under a 4 KB limit.

• server/signer/rotation.go: generate an Ed25519 key when the configured algorithm is EdDSA. server/signer/utils.go already maps Ed25519 keys to jose.EdDSA and signPayload is algorithm-generic, so signing, JWKS publication, and the discovery id_token_signing_alg_values_supported value already work once a key is generated.
• server/signer/local.go and cmd/dex/config.go: accept EdDSA in the local-signer config validation.
• server/oauth2.go: add EdDSA → SHA-512 to hashForSigAlg so at_hash/c_hash can be computed for EdDSA id_tokens (Ed25519 uses SHA-512 internally).

It also fixes a verifier gap that EdDSA exposes: the id_token_hint, /userinfo, and /token/introspect verifiers build oidc.NewVerifier with an oidc.Config that does not set SupportedSigningAlgs. go-oidc then defaults to RS256 only and rejects ES256/EdDSA Dex-issued tokens with malformed jwt before signerKeySet.VerifySignature ever runs. These three sites now pass the same algorithm list signerKeySet already uses, extracted into a shared supportedSigningAlgs.

Note: this verifier gap also affects ES256 today, not just EdDSA. I included the fix here because EdDSA cannot work end-to-end without it, but I'm happy to split it into a separate PR if you'd prefer to keep this one signer-only.

Closes #4442

Special notes for your reviewer

• Tests:
  • EdDSA cases added to the local-signer table tests, plus a new TestRotationStrategyForAlgorithm.
  • TestAccessTokenHashEdDSA for the at_hash mapping.
  • TestSignerKeySetWithEdDSALocalSigner and an end-to-end TestValidateIDTokenHintEdDSA that drives the real verifier path. The latter fails against the unpatched verifier with oidc: malformed jwt: unexpected signature algorithm "EdDSA"; expected ["RS256"].
• go test ./server/... ./cmd/..., golangci-lint run, and gofmt -l are all clean. No new dependencies (Ed25519 is stdlib).