AuthConfig

A named provider section's auth block: the workload's identity token, plus the keys the provider declares in ProviderConfigSpec.authExtras (a token URL, a federation rule id, ...), resolved by validation. Values are redacted in toString.

Extras are trimmed and a blank one is dropped, however the config is built - as a section's auth block is read - so a blank clientId is absent rather than posted empty, and a required key left blank is reported as missing.