ESD-66431: Fix rich consent signing with Android Keystore keys

[anirudh3997]

Title: Fix rich-consent DPoP signing for Android Keystore-backed RSA keys

---

Description

RichConsentsAPIClient casts the enrollment PrivateKey to RSAPrivateKey before signing the DPoP assertion. Android Keystore provides AndroidKeyStoreRSAPrivateKey, which supports signing via JCA Signature but does not implement java.security.interfaces.RSAPrivateKey. This causes Guardian.fetchConsent to crash with a ClassCastException before any network request is sent.

The fix replaces the direct cast and auth0/java-jwt Algorithm.RSA256 usage with a JCA Signature call using the existing PrivateKey abstraction — aligning the implementation with the SDK's allow/reject request path, which already uses SHA256withRSA / PrivateKey directly.

This is the same failure reported in #149.

References

• Fixes fetchConsent throws ClassCastException when the enrollment's private key is Android Keystore-backed #148, Rich consent fetch crashes with Android Keystore RSA private keys #149
• Cherry-pick of Fix rich consent signing with Android Keystore keys #150

Testing

Unit tests can be run with:
ANDROID_HOME=/path/to/Android/sdk ./gradlew :guardian:testDebugUnitTest

All existing RichConsentsAPIClientTest tests pass. The signing implementation now follows the same SHA256withRSA / PrivateKey approach already used by the SDK's allow/reject request path.

The crash was also reproduced and verified on a real device:

• Before fix: ClassCastException: AndroidKeyStoreRSAPrivateKey cannot be cast to RSAPrivateKey at RichConsentsAPIClient.createProofOfPossessionAssertion
• After fix: No crash, request reaches the server successfully
• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[manigandanparthasarathi-okta]

LGTM