Make server endpoint selection deterministic

[kevinherron]

Summary

When a client opens a secure channel, OPC UA doesn't tell the server which configured endpoint the client picked — the server has to figure that out from what's observable on the wire (the URL, security policy, security mode, and certificate). Previously, the server re-derived this guess on every request using first-match scans over the endpoint list. If several endpoints looked alike, whichever happened to come first won, so security-sensitive Session state (user token policies, the advertised certificate) could silently depend on collection ordering — and a Session could end up bound to a different endpoint than the one its channel actually negotiated.

This PR makes endpoint selection deterministic: the endpoint is selected once, at OpenSecureChannel time, from the channel's wire-observable identity, and that selection travels with every request on the channel. If a configuration contains endpoints the server could never tell apart on the wire, that's now a startup error instead of a silent arbitrary choice.

Changes

• EndpointSelectionKey (new, transport layer): the wire-observable identity of an endpoint — transport profile, URL path, SecurityPolicy, MessageSecurityMode, and certificate thumbprint. Selection yields exactly one endpoint or none, never an ordering-dependent pick. Endpoints differing only in host/port (hostname aliases) legitimately share a key and are disambiguated by preferring the client's requested URL.
• Endpoint propagation: the endpoint selected during OpenSecureChannel is captured on the channel and exposed via ServiceRequestContext.getEndpoint() (returns Optional), so SessionManager binds Sessions to the negotiated endpoint instead of re-deriving one.
• EndpointSelectionIndex (new, SDK layer): built once per resolved endpoint set; OpcUaServer.startup() fails with Bad_ConfigurationError when two non-equivalent endpoints share a selection key. resetEndpointDescriptionCache() re-validates and logs an error (it can't fail a running server).
• Discovery-only lockdown preserved: unsecured channels are restricted to discovery services unless an explicit SecurityPolicy.None endpoint currently exists for the transport/path — re-checked per request, so removing the None endpoint and resetting the description cache immediately locks down already-open unsecured channels.
• Spec-compliance guard: an OpenSecureChannel that omits receiverCertificateThumbprint on a secured policy is rejected explicitly with Bad_SecurityChecksFailed (Part 6 §6.7.2.3) instead of failing incidentally with a misleading error.

Breaking changes (intentional)

• Configurations with endpoints that are indistinguishable at OpenSecureChannel but differ in Session-sensitive properties (e.g. same URL/policy/mode/certificate but different user token policies) previously "worked" via arbitrary first-match; they now fail startup with Bad_ConfigurationError. Combine the token policies into a single endpoint, or make the endpoints wire-distinguishable.
• OpcUaServerConfigBuilder.setEndpoints now copies the supplied set; mutations after the call no longer affect the built config.
• ServiceRequestContext.getEndpoint() is a new abstract method returning Optional<EndpointDescription>; the endpoint-less ServiceRequest/UascServiceRequest constructors were removed.

Testing

• New SessionEndpointBindingTest covering session-to-endpoint binding, hostname-alias preference, discovery-only rejection, and ambiguity handling.
• mvn clean verify passes for opc-ua-stack/transport and opc-ua-sdk/sdk-server (full compile across all modules).

Follow-up tracked in DIG-20: precompute the discovery-only gate lookup in EndpointSelectionIndex.build to avoid the per-request endpoint scan on unsecured channels.

🤖 Generated with Claude Code