identity_openid  enable OpenID SSO support

ARGS:
config_url*   (url)       openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
client_id     (string)    unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
claim_name    (string)    JWT canned policy claim name, defaults to "policy"
claim_prefix  (string)    JWT claim namespace prefix e.g. "customer1/"

see [this guide](https://kubernetes.io/blog/2022/03/31/ready-for-dockershim-removal/).

### Beta APIs Off by Default

[New beta APIs will not be enabled in clusters by default](https://github.com/kubernetes/enhancements/issues/3136).
Existing beta APIs and new versions of existing beta APIs, will continue to be enabled by default.

### Signing Release Artifacts

La jerarquía es como:

* **Uvicorn**: un servidor ASGI
    * **Starlette**: (usa Uvicorn) un microframework web
        * **FastAPI**: (usa Starlette) un microframework para APIs con varias funcionalidades adicionales para construir APIs, con validación de datos, etc.

* **Uvicorn**:
    * Tendrá el mejor rendimiento, ya que no tiene mucho código extra aparte del propio servidor.

    }
  }

  // Fast path: no characters in [pos..limit) required decoding.
  return substring(pos, limit)
}

internal fun String.isPercentEncoded(
  pos: Int,
  limit: Int,
): Boolean =
  pos + 2 < limit &&
    this[pos] == '%' &&
    this[pos + 1].parseHexDigit() != -1 &&

type StubKMS struct {
	KeyNames []string
}

// Version returns the type of the KMS.
func (s StubKMS) Version(ctx context.Context) (string, error) {
	return "stub", nil
}

// APIs returns supported APIs
func (s StubKMS) APIs(ctx context.Context) ([]madmin.KMSAPI, error) {
	return []madmin.KMSAPI{
		{Method: http.MethodGet, Path: "stub/path"},
	}, nil
}

// Status returns a set of endpoints and their KMS status.

      When doing so, still annotate nullable parameters and the return type as `@Nullable`.
  * Do not use `@Contract` for public APIs.
  * For polynull public APIs, the solution has to be decided on a case-by-case basis.

Do not remove `null` checks on public API boundaries, even if the annotations (or rather lack of them) suggest this.

        .build()
    assertThat(request.tag<Any>()).isNull()
    assertThat(request.tag(Any::class)).isNull()
    assertThat(request.tag(String::class)).isNull()

    // Alternate access APIs also work.
    assertThat(request.tag<String>()).isNull()
    assertThat(request.tag(String::class)).isNull()
  }

  @Test
  fun defaultTag() {
    val tag = "1234"
    val request =
      Request

// streaming MetaValue channel for JSON values at the configured emitDepth.
func (d *Decoder) Stream() chan *MetaValue {
	go d.decode()
	return d.metaCh
}

// Pos returns the number of bytes consumed from the underlying reader
func (d *Decoder) Pos() int { return int(d.pos) }

// Err returns the most recent decoder error if any, or nil
func (d *Decoder) Err() error { return d.err }

// MaxDepth will set the maximum recursion depth.

	base   *src.PosBase
	line   int
	pos    int
}

func NewSlice(base *src.PosBase, line int, tokens []Token) *Slice {
	return &Slice{
		tokens: tokens,
		base:   base,
		line:   line,
		pos:    -1, // Next will advance to zero.
	}
}

func (s *Slice) Next() ScanToken {
	s.pos++
	if s.pos >= len(s.tokens) {
		return scanner.EOF
	}
	return s.tokens[s.pos].ScanToken
}

	scanner := newScanner(r)
	for scanner.pos < atomic.LoadInt64(&scanner.end) {
		c := scanner.next()
		if scanner.readerErr != nil {
			t.Fatal(scanner.readerErr)
		}
		if c != data[i] {
			t.Fatalf("expected %s, got %s", string(data[i]), string(c))
		}
		t.Logf("pos=%d remaining=%d (%s)", i, r.Len(), string(c))
		i++
	}
}

type mockReader struct {
	pos       int
	mockData  byte
	failAfter int
}