fix(source): align update notifications and retry semantics

[maxlambrecht]

Context

Follow-up from source lifecycle review findings for X509Source and JwtSource: update notifications could fire on reconnect without material changes, initial sync retried forever on Workload API INVALID_ARGUMENT, and some X.509 Workload API behaviors needed clearer documentation.

Changes

• Dedupe unchanged X.509 contexts / JWT bundle sets in apply_update, so updated() only notifies on actual material changes.
• Fail X509Source / JwtSource initial sync fast on Workload API gRPC INVALID_ARGUMENT; steady-state reconnect behavior is unchanged.
• Add WorkloadApiError::is_invalid_argument().
• Document the X.509 expired-SVID update rejection behavior and snapshot retention.
• Add mirror comments for duplicated X.509/JWT source supervisor lifecycle code.
• Document ignored X.509 CRLs, default-only stream_x509_svids, SPIRE-specific NoIdentityIssued message matching, and federated-bundle overwrite precedence.

Security

• Advisory: none.
• Fix: reduces spurious rotation handling and avoids indefinite initial-sync retries for non-retryable invalid Workload API requests while preserving conservative X.509 update rejection behavior.

Compatibility

• MSRV: unchanged.
• Breaking changes: none.
• Behavior changes:
  • updated() no longer fires for unchanged material re-delivered on reconnect.
  • Initial sync now fails fast on gRPC INVALID_ARGUMENT instead of retrying indefinitely.
• Affected crates/features: spiffe with x509-source, jwt-source, workload-api-x509, and workload-api-jwt.

Testing

• cargo fmt -p spiffe -- --check
• cargo clippy -p spiffe --features x509-source,jwt-source,jwt-verify-rust-crypto,logging --tests
• cargo test -p spiffe --lib --features x509-source,jwt-source,jwt-verify-rust-crypto,logging (224 passed)
• cargo doc -p spiffe --no-deps --features x509-source,jwt-source,jwt-verify-rust-crypto,logging checked; remaining unresolved links are pre-existing outside this change area.

Release notes

• X509Source / JwtSource: updated() now ignores re-delivered, unchanged material and only notifies when the held context or bundle set changes.
• X509Source / JwtSource: Initial sync now fails fast on Workload API gRPC INVALID_ARGUMENT instead of retrying forever.
• WorkloadApiError: Added WorkloadApiError::is_invalid_argument().
• X509Source / WorkloadApiClient: Documented expired-SVID rejection, ignored X.509 CRLs, default-only stream_x509_svids, SPIRE-specific NoIdentityIssued matching, and federated-bundle overwrite precedence.

---

This change is