docs: Sentry Ed25519 workload identity keys

[nelson-parente]

Summary

• Documents the Dapr 1.18 change where Sentry switched workload identity X.509 key generation from ECDSA P-256 to Ed25519 (runtime PR dapr/dapr#9598).
• Covers the positive-side story (what changed, why, rolling upgrade compatibility) as well as FIPS and downgrade constraints.
• The related injector/operator RSA webhook serving certs change (dapr/dapr#9873) is mentioned for context but tracked separately as gap R5.

Files touched

File	Change
daprdocs/content/en/concepts/security-concept.md	New "Workload identity key algorithm" subsection under "Secure Dapr to Dapr communication": algorithm comparison table, rationale for Ed25519, explanation of why injector/operator stay RSA, why JWT signing stays RSA-2048, mixed-version upgrade note, FIPS callout (Ed25519 not FIPS-140 approved; BYO-CA is the workaround), downgrade floor alert (1.17.7). Also fixes stale "ECDSA private key" sentence in the same section.
daprdocs/content/en/operations/security/mtls.md	New "Workload identity key algorithm" section at the top of the page pointing to the concept page for details. Adds BYO-CA note (supplied issuer key algorithm is what Sentry uses — relevant for FIPS). Fixes stale "ECDSA PEM encoded" in self-hosted BYO-certs prose. Adds inline note on Kubernetes openssl example clarifying RSA keys are also accepted.

Test plan

• Hugo renders the new alerts and table without errors (hugo serve locally).
• The {{% ref "security-concept.md#workload-identity-key-algorithm" %}} anchor link resolves.
• The {{% ref "mtls#bringing-your-own-certificates" %}} link resolves.
• No broken links (htmltest or equivalent passes).
• Spot-check prose for accuracy against dapr/dapr#9598 diff.
• FIPS callout reviewed for accuracy (Ed25519 / Curve25519 is not on FIPS 140-2/-3 approved list).
• Downgrade floor version (1.17.7) confirmed against dapr/dapr#9904.

Related

• Runtime PR: dapr/dapr#9598 — Sentry: Use Ed25519 for X.509 certificate key generation
• Ed25519 PEM-decoder fix (backported to 1.17.7): dapr/dapr#9904
• Injector/Operator RSA webhook certs (gap R5, separate PR): dapr/dapr#9873

Targets v1.18. Draft pending review.