fix(helper): preserve multiple X509 bundle authorities

[maxlambrecht]

What

Fix KeyStoreHelper truststore updates for X.509 bundle authorities:

• Store multiple authorities for the same trust domain under distinct aliases.
• Remove stale generated aliases for a trust domain before storing a replacement bundle.
• Assign aliases deterministically by sorting authorities by encoded certificate bytes.

Why

storeBundle initialized the alias index but never incremented it, so later authorities could overwrite earlier ones. In watch mode, bundle rotations could also leave removed authorities trusted under old aliases, and nondeterministic Set iteration could cause unnecessary alias churn.

How tested

Ran ./gradlew :java-spiffe-helper:test --tests io.spiffe.helper.keystore.KeyStoreHelperTest.

[Copilot]

Pull request overview

Fixes KeyStoreHelper truststore alias generation so multiple X.509 authorities in the same trust-domain bundle are persisted under distinct aliases, and adds a regression test to validate multiple authorities are stored.

Changes:

• Increment the per-bundle alias index when storing authority certificates to avoid overwriting.
• Add a new unit test that injects a bundle containing multiple authorities for the same trust domain and verifies both are present in the truststore.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
java-spiffe-helper/src/main/java/io/spiffe/helper/keystore/KeyStoreHelper.java	Fixes alias generation loop to use distinct aliases for multiple authorities.
java-spiffe-helper/src/test/java/io/spiffe/helper/keystore/KeyStoreHelperTest.java	Adds regression test ensuring multiple authorities for one trust domain are persisted under separate aliases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.