Issue and validate a SPIFFE JWT-SVID for service-to-service authorization in an HTTP header

Steps

1. Ensure the workload entry exists in SPIRE for the calling service with the appropriate selector
2. From the caller workload, obtain a JWT-SVID for a specific audience using the go-spiffe SDK: 'source.FetchJWTSVID(ctx, jwtsvid.Params{Audience: "spiffe://example.org/downstream"})' or via CLI: 'spire-agent api fetch jwt -audience spiffe://example.org/downstream -socketPath /run/spire/sockets/agent.sock'
3. Pass the JWT in the Authorization header: 'Authorization: Bearer <JWT_SVID_TOKEN>'
4. On the receiving service, validate using go-spiffe: 'jwtsvid.ParseAndValidate(token, jwtSource, []string{"spiffe://example.org/downstream"})' which checks signature, expiry, and audience
5. Inspect the validated SVID's ID field ('svid.ID.String()') to authorize based on the caller's SPIFFE ID
6. Handle token rotation by re-fetching the JWT-SVID before each outbound request, as JWT-SVIDs have a short TTL (typically 5 minutes)