DGS-24778 Pass context when clients make KEK calls to DEK Registry

[Robert Yokota (rayokota)]

Please prefix all TypeScript pull-requests with [Typescript]

What

Checklist

• Contains customer facing changes? Including API/behavior changes
• Did you add sufficient unit test and/or integration test coverage for this PR?
  • If not, please explain why it is not required

References

JIRA:

Test & Review

Open questions / Follow-ups

[Copilot]

Pull request overview

This PR threads Schema Registry “context” (parsed from a context-qualified subject like :.myctx:subject) through KEK lookups/registrations to the DEK Registry, ensuring KEKs are resolved within the correct context rather than the default context.

Changes:

• Parse context from RuleContext.subject and pass it into KEK getKek / registerKek calls.
• Extend the DEK Registry client (and mock) KEK APIs to accept an optional context and include it in cache keys + REST request URLs.
• Add a Jest spec validating that context-qualified subjects resolve the expected KEK vs default-context subjects.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
schemaregistry/test/rules/encryption/encrypt-executor.spec.ts	Adds a test ensuring KEK operations use the context derived from a qualified subject.
schemaregistry/rules/encryption/encrypt-executor.ts	Introduces context parsing and passes context through KEK registry calls.
schemaregistry/rules/encryption/dekregistry/mock-dekregistry-client.ts	Updates mock KEK APIs and cache keys to support optional context.
schemaregistry/rules/encryption/dekregistry/dekregistry-client.ts	Updates client KEK APIs + REST URL construction/caching to include optional context.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.