fix(helm): improve spiffe id configuration in ci overlay

[grs]

Summary

Updates the local SPIRE dev/ci overlay so sandbox JWT-SVID subjects include namespace, pod name, and the OpenShell sandbox ID as one opaque final SPIFFE ID segment and will apply to any namespace in which there are OpenShell managed pods. This makes it work whatever workspace mapping mode is in use. It is also more protected against spoofing.
Note: neither the gateway nor the supervisor have any specific requirements for the form of the SPIFFE ID.

Related Issue

Fixes #3037

Changes

• updates the spire stack values to change the spiffe id configuration
• updates docs
• updates text in token grant and token exchange demos
• adds some fixes to the token grant demo to allow https on the openshell gateway and in retrieval of the spire oidc keys

Testing

• mise run pre-commit passes
• existing examples work with change
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.