KNOX-3396: Return 4xx for type-mismatched register bodies and issuer-limit-reached instead of 500

[smolnar82]

KNOX-3396 - Fix trusted-OIDC-issuer register API returning 500 for client-actionable errors

What changes were proposed in this pull request?

Follow-up to KNOX-3368 (#1327), hardening the POST register endpoint of the trusted-OIDC-issuer admin API so that client-actionable conditions return the correct 4xx status instead of a misleading 500:

1. Typed request bean. registerIssuer now deserializes the body into a new RegisterIssuerRequest DTO instead of a generic Map<String, Object> with blind casts.
2. Differentiated exception handling. The service throws IllegalStateException when the configured MAX_TRUSTED_ISSUERS limit is reached: an operator-facing capacity condition. This is now caught separately and mapped to 409 issuer_limit_reached, so it is distinguishable from a genuine storage failure (still 500 storage_error).

Parsing remains inside the try block, so the audit-on-every-path behavior and the malformed-JSON handling are unchanged. Validation ordering, the SSRF/HTTPS gate, the error-response contract, and the other endpoints GET/DELETE/refresh-jwks) are untouched.

How was this patch tested?

Automated unit tests in TrustedOidcIssuersResourceTest (module gateway-service-knoxidf). Two cases were added:

• testRegisterWrongTypeFieldReturnsBadRequest: an array-valued clusterName now returns 400 invalid_request (was 500 before the fix).
• testRegisterIssuerLimitReached: the service throwing IllegalStateException now returns 409 issuer_limit_reached.

Integration Tests

N/A

UI changes

N/A

[smolnar82]

Cc. @hsheinblatt

[github-actions]

Test Results

46 tests   46 ✅  7s ⏱️
 3 suites   0 💤
 3 files     0 ❌

Results for commit 5ef0b01.

♻️ This comment has been updated with latest results.