test(dpop): entitle opentdf-dpop client in shared subject condition set (DSPX-3397)

The DPoP tests authenticate as the opentdf-dpop client, but otdf_client_scs only
entitled opentdf/opentdf-sdk, so the DPoP rewrap reached authorization and was
denied (entitled:false -> 403). Add opentdf-dpop to the clientId allowlist so the
DPoP-bound client is entitled like the other test clients.

Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

Author: dmihalcik

xtest/fixtures/obligations.py

@@ -17,7 +17,8 @@
 def otdf_client_scs(otdfctl: OpentdfCommandLineTool) -> abac.SubjectConditionSet:
     """
     Creates a standard subject condition set for OpenTDF clients.
-    This condition set matches client IDs 'opentdf' or 'opentdf-sdk'.
+    This condition set matches client IDs 'opentdf', 'opentdf-sdk', or
+    'opentdf-dpop' (the DPoP-bound client used by the DPoP tests).
 
     Returns:
         abac.SubjectConditionSet: The created subject condition set
@@ -32,7 +33,11 @@ def otdf_client_scs(otdfctl: OpentdfCommandLineTool) -> abac.SubjectConditionSet
                             abac.Condition(
                                 subject_external_selector_value=".clientId",
                                 operator=abac.SubjectMappingOperatorEnum.IN,
-                                subject_external_values=["opentdf", "opentdf-sdk"],
+                                subject_external_values=[
+                                    "opentdf",
+                                    "opentdf-sdk",
+                                    "opentdf-dpop",
+                                ],
                             )
                         ],
                     )