Opaque, integrity-protected request state for MRTR.

Under Multi Round-Trip Requests a server that needs more input answers with an InputRequiredResult and finishes the request. The client then retries, echoing back a requestState string. That is how the server picks up where it left off without keeping anything server-side, which is what lets a retry land on a different node.

The catch is that the state travels through the client, so it is attacker-controlled input by construction. The spec requires integrity protection and rejection of state that fails verification. This module seals a term into a blob authenticated with HMAC-SHA256, bound to:

• the authenticated principal, so one caller cannot present another's state;
• an expiry, so a captured blob is not useful indefinitely;
• the originating method and its salient parameters, so state from one call cannot be replayed onto a different one.

These bound the replay window and stop cross-user and cross-request reuse. They do not make a blob single-use: a server that needs that (a one-time redemption, say) has to enforce it itself.

The signing key

From the request_state_key environment variable. Without one, an ephemeral key is generated per node, which is fine for a single node and wrong for a cluster: a retry landing on another node fails verification. A warning is logged once so that is not discovered in production.