Implement mutual TLS service-to-service communication using SPIFFE identities for authorization

Steps

1. Both client and server workloads obtain their X.509-SVIDs from the SPIRE Workload API and maintain a live X509Source that refreshes the certificate automatically
2. On the server side, configure the TLS listener to require client certificate authentication (tls.RequireAndVerifyClientCert) and supply the SPIFFE trust bundle as the CA pool
3. On the client side, configure the TLS dialer with the client certificate (SVID) and the trust bundle as the CA pool; do not disable certificate verification
4. After the TLS handshake, extract the peer's SPIFFE ID from the verified client certificate's SAN URI field and compare it against an allowlist of authorized SPIFFE IDs
5. Implement authorization logic based on SPIFFE IDs (e.g., only spiffe://example.org/service/payment-processor may call the orders endpoint); log and reject unauthorized peers
6. Use the go-spiffe tlsconfig helpers (spiffetls.MTLSServerConfig, spiffetls.MTLSClientConfig) to reduce boilerplate and ensure correct trust bundle handling