AAP-62657 Implement logic to extract and populate JWT claims from Controller Jobs

[melissalkelly]

AAP-62657

What is being changed?

Adds populate_claims_for_workload() function to awx/main/tasks/jobs.py:

• Extracts 21 JWT claims - Populates all claims defined in AutomationControllerJobScope
  from django-ansible-base
• Uses DAB constants - References claim names via AutomationControllerJobScope.CLAIM_* for
  consistency with Gateway
• Handles null/missing fields - Omits claims when workload attributes are null or empty
  strings
• Comprehensive tests - Includes 4 parametrized test cases covering complete jobs, minimal
  jobs, empty strings, and edge cases

Why is this change needed?

This function is the Controller-side implementation for OIDC workload identity claim population.
While the scope is defined in django-ansible-base (AAP-62105) and validated by Gateway
(AAP-62534), Controller needs to provide the actual job metadata.

The function will be called from RunJob.build_jwt() (to be implemented in AAP-62693) to:

• Extract job metadata into the standardized claim format
• Pass claims to the Workload Identity Client
• Enable Gateway to issue signed identity tokens for running jobs

How does this change address the issue?

• All 21 claims populated
• Null handling implemented
• Tests verify behavior

Notes

This function is not yet called - it will be integrated when RunJob.build_jwt() is
implemented in AAP-62693. The function signature and behavior are complete and tested, ready for
integration.

Related Tickets

• AAP-62657 (this ticket) - Implement claim population logic
• AAP-62693 - Integrate Workload Identity Client to request JWTs on job launch (will call
  this function)
• AAP-62105 - Define AutomationControllerJobScope in django-ansible-base
• AAP-62534 - Gateway validates claims against scope

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• Other

[melissalkelly]

CI is failing with ModuleNotFoundError: No module named 'ansible_base.lib.workload_identity'

• This PR depends on [AAP-62105] Implement default JWT scope aap_controller_automation_job for OIDC workload identity django-ansible-base#923 (AAP-62105) which creates 'ansible_base.lib.workload_identity'
• AAP-62105 was merged to devel on January 29, 2025
• CI is using a cached version of django-ansible-base from before the merge