fix: Enforce TLS 1.3 for the Vault client

[minhtule]

Related Tickets & Documents

• Issue: Vault SSH CA client should enforce TLS 1.3 #348

Changes

• Enforce a TLS 1.3 minimum on the Vault client used for SSH CA signing (Vault's default permits TLS 1.2).

[Copilot]

Pull request overview

This PR updates the Vault client configuration used by the SSH CA signing path to enforce a minimum TLS version of 1.3, aligning the implementation with Issue #348’s security requirement.

Changes:

• Set the Vault HTTP client transport’s TLSClientConfig.MinVersion to tls.VersionTLS13.
• Add a unit test to assert that newVault enforces TLS 1.3 on the underlying HTTP transport.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/sshhandler/vault.go	Forces Vault client TLS minimum to 1.3 by updating the underlying http.Transport TLS config.
internal/sshhandler/vault_test.go	Adds a regression test validating the TLS 1.3 minimum is set on the Vault client transport.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.19%. Comparing base (ae1a656) to head (aa1f153).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #349      +/-   ##
==========================================
+ Coverage   86.07%   86.19%   +0.11%     
==========================================
  Files          40       40              
  Lines        2830     2832       +2     
==========================================
+ Hits         2436     2441       +5     
+ Misses        269      265       -4     
- Partials      125      126       +1     

Flag	Coverage Δ
integration	55.00% <100.00%> (+0.14%)	⬆️
unit	78.88% <100.00%> (+0.33%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/sshhandler/vault.go	77.67% <100.00%> (+0.40%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[clement0010]

LGTM 👍🏻