fix(sdk): kasKeyCache has no mutex protection — data race under concurrent use

[eugenioenko]

Motivation

kasKeyCache in sdk/kas_client.go uses a bare map[kasKeyRequest]timeStampedKASInfo with no synchronization. When multiple goroutines call LoadTDF or rewrap concurrently on the same SDK instance, get(), store(), and clear() race on the shared map. Go maps are not safe for concurrent read/write — this can panic or silently corrupt state.

The sibling kasAllowlistCache was fixed in #3898 by adding a sync.Mutex. The same fix should be applied to kasKeyCache.

Details

• File: sdk/kas_client.go, kasKeyCache struct (line ~422)
• Methods affected: get(), store(), clear()
• Fix: Add a sync.Mutex (or sync.RWMutex) and lock in each method, matching the pattern from kasAllowlistCache