CVE-2026-108062 – Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.