Included new invoker_api methods and self control call with security method obtained

/test/capif_sdk_config_sample_test.json

# Keys and certificates generated by the samples and testing clients

**/test_*_certificate_folder/

network_app_samples/network_app_provider_sample/aef_server_certificate/

This repository provides an implementation sample of a [Provider-Network App](./network_app_samples/network_app_provider_sample/network_app_provider.py).

In this sample, the provider publishes two APIs and starts running the servers of each API on local environment.

In this sample, the provider onboards, publishes two APIs, `6G-resilience` ([nef_upf_vendor_1.json](./network_app_samples/network_app_provider_sample/nef_upf_vendor_1.json)) and `5G-Network-App-API` ([nef_upf_vendor_2.json](./network_app_samples/network_app_provider_sample/nef_upf_vendor_2.json)), and starts the servers of both APIs on the local machine. Run it from its folder, after installing the `samples` extra:

```console

cd network_app_samples/network_app_provider_sample

python network_app_provider.py

```

The servers of the sample work as AEFs:

- They use HTTPS, at `https://localhost:8088` (`6G-resilience`) and `https://localhost:8888` (`5G-Network-App-API`), the addresses published in the API descriptions.

- Their TLS certificate is self-signed and valid for `localhost`. The sample creates it the first time it runs, in its `aef_server_certificate` folder (`aef_server.crt` and `aef_server.key`). It is only meant for local tests: a real AEF needs a certificate for its own host name, issued by a CA that its invokers trust.

- The API resources require the access token issued by CAPIF to the invoker (`Authorization: Bearer <token>`), which they validate with the public key of the CAPIF certificate. The `check-authentication` operation (`POST /aef-security/v1/check-authentication`) does not require it, as it uses HTTPS with server authentication only.

### Important information for Provider consumers

For testing APIs availability, after running both samples([Provider-Network App](./network_app_samples/network_app_provider_sample/network_app_provider.py) and [Invoker-Network App](./network_app_samples/network_app_invoker_sample/network_app_invoker.py)) the invoker app will return the access token.

Run it from its folder. Its [configuration](./network_app_samples/network_app_invoker_sample/capif_sdk_config_sample.json) trusts the certificate of the provider sample servers through `api_invocation.ca_cert`, so `invoke_api()` and `check_authentication()` can verify them. For example, to call one of the sample APIs (`aef_id` is needed because two AEFs expose it):

```python

response = discoverer.invoke_api("6G-resilience", "GET", resource="RESILIENCE_MANAGEMENT", aef_id="AEF...")

```

Also, in the same Invoker-Network folder is available a [Postman structure](./network_app_samples/network_app_invoker_sample/postman/).In order to test these APIs, the access token returned in the Invoker-Network App must be set in the Postman environment, more specifically in the `access_token` variable.

Another alternative is to import the [Postman structure](./network_app_samples/network_app_invoker_sample/postman/) in your own postman account, and let the [Invoker-Network App](./network_app_samples/network_app_invoker_sample/network_app_invoker.py) update the access token in your Postman environment. To do so, set your Postman API key and environment ID as environment variables before running it (never write them in the code):

If these variables are not set, the Invoker-Network App skips the Postman update.

The Postman requests use HTTPS. As the certificate of the sample servers is self-signed, add `aef_server.crt` as a CA certificate in Postman (*Settings > Certificates > CA certificates*), or turn off SSL certificate verification for these requests.

### Important information for Invoker consumer

In the `invoker_folder`, it will be located several folders with each `capif_username` it has been onboarded as a provider. For each folder, it will be found:

- **The SDK no longer configures logging when imported.** It does not create a `logs/` folder or change your application's logging anymore, and `debug_mode` no longer enables the `urllib3` (HTTP) debug logs. To keep getting the SDK logs, call `enable_default_logging()`, as explained in the Logging section below.

- **Fewer dependencies.** `pip install opencapif_sdk` now installs only what the SDK uses, and `PyJWT` is now declared explicitly. Flask, Flask-JWT-Extended, Werkzeug, Jinja2, MarkupSafe, connexion, python-dateutil, six, text-unidecode and typing-extensions are no longer installed with the SDK. If your code uses any of them, install them yourself, or use `pip install "opencapif_sdk[samples]"` for the Flask-based samples.

- **`pyOpenSSL` replaced by `cryptography`.** Keys and certificate signing requests (CSRs) are now created with `cryptography` 50.x, the same version used by the OpenCAPIF services, and `pyOpenSSL` is no longer installed with the SDK (its latest versions no longer include the CSR functions that the SDK used). The keys and CSRs are equivalent to the previous ones (RSA 2048, SHA-256 and the same subject fields), so provider and invoker folders created with earlier versions keep working. If your code imports `OpenSSL`, install `pyOpenSSL` yourself.

- **Event subscription methods renamed.** `update_subcription()` and `patch_subcription()` are now `update_subscription()` and `patch_subscription()`, in both `capif_invoker_event_feature` and `capif_provider_event_feature`. The old names have been removed.

- **Invoker details file.** The key `registered_security_contexes` of `capif_api_security_context_details-<capif_username>.json` is now `registered_security_contexts`. For invoker folders created with earlier versions, run `discover()` again before `get_tokens()`.

- **New mandatory invoker setting: `security_context.pref_security_context`.** It lists the security methods requested to CAPIF for every discovered API (`OAUTH`, `PKI` and/or `PSK`, in order of preference), and must contain at least one method, with no other values (case-insensitive); otherwise, creating a `service_discoverer` raises a `ValueError`. Add it to the `invoker` section of your configuration, or set the `INVOKER_SECURITY_CONTEXT_PREF_SECURITY_CONTEXT` environment variable. See the Configuration Overview below.

### Unit tests

The unit tests check the SDK without a running OpenCAPIF: CAPIF and the AEFs are simulated. Run them from the root of the repository with:

The unit tests check the SDK without a running OpenCAPIF: CAPIF and the AEFs are simulated (`test/unit/fake_capif.py`), so the tests can check the requests sent by the SDK, the files it writes and the errors it raises. They cover the onboarding, update and offboarding of providers and invokers, the publication of APIs, discovery, security context and tokens, API invocation, event subscriptions, API invocation logs, the API schema translator, the generation of keys and CSRs, and the configuration from files and environment variables. Run them from the root of the repository with:

```console

make unit_tests

It runs `python -m pytest test/unit` with the Python of the repository `venv` if it exists, or `python3` otherwise (choose another one with `make unit_tests PYTHON=/path/to/python`). Running it as `python -m pytest` from the repository root makes the tests use the code of the repository, and not an `opencapif_sdk` installed in your environment.

The unit tests also run in the staging CI pipeline (`staging_unit_tests` job), which installs `installation/requirements.txt` in a `venv` and runs `make unit_tests`.

The other tests of the `test` folder are integration tests that need a running OpenCAPIF.

### End-to-end tests

3. Provider: offboarding. It always runs, even if a previous step failed, to leave OpenCAPIF clean.

The script exits with code `0` only if every step succeeds. If any step fails, it shows which one, with its error, and exits with code `1`, so it can be used to stop a pipeline.

In the staging CI pipeline, the `staging_local_install` job deploys OpenCAPIF with `prepare_capif_for_sdk.sh` and then runs this script.

PyYAML>=6.0.1,<7

# --- Crypto/TLS ---

cryptography>=43.0.1,<46

pyOpenSSL>=25.1.0,<26

cryptography==50.0.0

# --- Dev / QA ---

pytest>=8.3.2,<9