[ABCA] Implement a Challenge Endpoint - #51574

services/src/main/java/org/keycloak/protocol/oidc/endpoints/ClientAttestationChallengeEndpoint.java:95

• The successful response bypasses Cors, so a cross-origin wallet receives no Access-Control-Allow-Origin and cannot read either the challenge body or its custom header. Apply CORS to the success response (the SSL error path already does this) and expose the challenge header.

        return Response.ok(challengeResponse)
                .header(HttpHeaders.CACHE_CONTROL, "no-store")
                .header("Pragma", "no-cache")
                .header(HttpHeaders.DATE, DateTimeFormatter.RFC_1123_DATE_TIME.format(ZonedDateTime.now(ZoneOffset.UTC)))
                .header(AttestationBasedClientAuthenticator.OAUTH_CLIENT_ATTESTATION_CHALLENGE_HEADER, challenge)

services/src/main/java/org/keycloak/authentication/authenticators/client/AttestationBasedClientAuthenticator.java:146

• Browser clients cannot read this fresh challenge: TokenEndpoint.java:125 exposes only Access-Control-Allow-Methods, and AuthorizeClientUtil applies that CORS configuration to this authentication failure. Add OAuth-Client-Attestation-Challenge to the token endpoint's exposed headers so the required retry flow works cross-origin.

            Response response = Response.fromResponse(ClientAuthUtil.errorResponse(BAD_REQUEST.getStatusCode(), USE_ATTESTATION_CHALLENGE, ex.getMessage()))
                    .header(OAUTH_CLIENT_ATTESTATION_CHALLENGE_HEADER, ex.getChallenge())

tests/base/src/test/java/org/keycloak/tests/oid4vc/abca/OIDCAttestationBasedClientAuthenticationTest.java:287

• The lifecycle tests cover reuse but not expiration, although rejecting expired challenges and returning use_attestation_challenge with a fresh header is an explicit requirement. Add an expired-challenge integration case, for example by temporarily setting the nonce lifetime negative as existing OID4VC tests do.

    @Test
    public void testClientAttestationChallengeCannotBeReused() {