Support pkimetal via Unix socket

[Copilot]

Implementation Plan for pkimetal Unix Socket Support

• Add Socket field to PKIMetalConfig struct in lint_cert_via_pkimetal.go
• Modify execute() method to create HTTP client with Unix socket transport when Socket is configured
• Update docker-compose.yml to:
  • Upgrade pkimetal image from v1.20.0 to v1.32.0
  • Configure pkimetal to use Unix socket via Viper YAML config
  • Set up volume mount for Unix socket sharing
• Update test/config/zlint.toml to use socket configuration
• Update test/config-next/zlint.toml to use socket configuration
• Address code review feedback:
  • Add timeout to Unix socket HTTP client
  • Use url.JoinPath for consistent URL construction
  • Set timeout on HTTP client for regular HTTP connections
  • Improve comment clarity
  • Refactor to enable connection reuse and simplify code
  • Use sync.Once for thread-safe client initialization
  • Apply timeout per-request instead of per-client
• Create pkimetal.yaml configuration files with Viper-compatible settings
• Run security checks

Summary

All changes completed. The implementation enables pkimetal to run via Unix socket with thread-safe connection pooling.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Support pkimetal via Unix Socket</issue_title>
<issue_description>I've contributed support to pkimetal to listen on a unix socket. This is included in release v1.32.0.

Now we need Boulder to support using pkimetal via Unix socket.

This enables running a pkimetal container as a sidecar to cert-checker & boulder-ca with networking disabled, which we want to do to reduce risk in our production environment.

In lint_cert_via_pkimetal.go, we'll need to add a new Socket option to PKIMetalConfig, and construct an HTTP Client with a Transport using a net.Dialer DialContext with network "unix" and the unix socket path.

The integration test docker-compose.yml will be need to be updated to use pkimetal v1.32.0. It will need to be configured to use a unix socket, and zlint.toml in config and config-next will need to be updated with the new socket configuration to use that.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Support pkimetal via Unix Socket #8530

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

@Copilot, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

[mcpherrinm]

To enable connection reuse, we shouldn't create a new http.Client (and importantly, http.Transport) for each request.

This code is a bit more verbose than it needs to be: Only the dummy value in place of pkim.Addr and Transport needs to change if pkim.Socket is set.

[mcpherrinm]

@copilot

[Copilot]

Refactored to store the HTTP client in the struct for reuse across requests, enabling connection pooling. The code now only conditionally sets the Transport and base URL, eliminating duplication. Changes in commit 86c1eb9.