[NopeCharon]

What

DefaultX509Source.newSource, DefaultJwtSource.newSource and CachedJwtSource.newSource now keep the Workload API client they create, and the default init timeout, in local variables. Before, they stored them in the options object passed in. newSource no longer modifies its argument, and each call without a configured workloadApiClient creates its own client. A client set in the options is used, and closed with the source, as before.

Fixes #497

Why

When init failed, for example because initTimeout expired before the SPIRE agent was up, newSource closed the source and so closed the client it had created. The options still held that client. Every later newSource(options) call reused it and failed immediately with IllegalStateException: Cannot register watch on closed Workload API client. A startup loop retrying newSource with the same options never recovered, even after the agent became available.

After a successful call, a second source created from the same options shared the first one's client, so closing either source broke the other.

This is the same pattern #494 fixes for DefaultWorkloadApiClient.newClient and ClientOptions, one level up.

How tested

• newSource_timeout_retryWithSameOptions_createsNewClient in DefaultX509SourceTest, DefaultJwtSourceTest and CachedJwtSourceTest calls newSource twice with the same options, pointing at a socket nobody listens on. It checks that both calls fail with the init timeout and that the options still have no client. The JWT variants also check that initTimeout is still unset.
• Without the change, all three fail on the second call: expected: <Timeout waiting for ...> but was: <Cannot register watch on closed Workload API client>.
• ./gradlew :java-spiffe-core:check :java-spiffe-core:japicmp :java-spiffe-core:javadoc on JDK 17.

[maxlambrecht]

Reviewed against #497. The fix consistently avoids mutating caller options across all three source factories while preserving existing behavior for explicitly supplied clients.
LGTM