AUTH-9012 Verify Access app identity with signed metadata

## Problem

`GetAppInfo` trusted unsigned `CF-Access-Domain` and `CF-Access-Aud` response headers when selecting cached Access tokens. An attacker-controlled endpoint could spoof another application's identity, causing cloudflared to load and send that application's cached token.

## Fix

Discover applications through the edge's signed metadata JWT, validate its claims and requested hostname, and verify its RS256 signature against a canonicalized Cloudflare Access JWKS endpoint. Cache JWKS atomically, refresh on key rotation, and validate cached token audiences before use.

This relies on access-edge-engine [early return for cf-access-metadata-requests](https://gitlab.cfdata.org/cloudflare/ea/access-edge-engine/-/blob/main/bin/access-engine-server/src/engine/http/mod.rs?ref_type=heads#L1464-1472) when processing seldhosted apps

Jira: AUTH-9012 VULN-141860

Tested manually previous working behaviour and the VULN fix