…pec (grpc#12961)

- Modify `SpiffeUtil.extractCert` to ignore all but the first
certificate if the `x5c` JWK parameter contains multiple values.
- Modify `SpiffeUtil.extractCert` to skip the JWK entry (`continue`)
instead of stopping execution (`break`) or throwing when `x5c` is
missing or contains an empty list, complying with the requirement that
entries without `x5c` must be ignored.

When trying to enter a Context, the call method doesn't work well with non-throwing Callables, such as lambdas. This change adds a Supplier overload to Context which would solve this, since it doesn't declare a checked exception.

Fixes grpc#12927

…#12985)

When a main channel enters IDLE mode (e.g. after 30 minutes of
inactivity), it shuts down its Load Balancer (such as RLS). This in turn
shuts down any Out-of-Band child channels created by the LB. Previously,
when an OOB channel finished terminating, it called
`transportFactory.close()`, which prematurely closed the parent
channel's shared `ClientTransportFactory` (`NettyTransportFactory`). As
a result, when the main channel later attempted to exit IDLE mode or
reconnect, `transportFactory.newClientTransport()` threw
`IllegalStateException: The transport factory is closed`, causing an
uncaught exception panic in the SynchronizationContext.

This change introduces `RefCountedClientTransportFactory` to track
active references to the underlying `ClientTransportFactory`. When OOB
channels inherit `originalTransportFactory` via
`createResolvingOobChannelBuilder()`, `retain()` is invoked. Calling
`close()` on the transport factory now decrements the reference count,
ensuring the underlying delegate factory is only closed when all parent
and child channel references have been released.

b/545260270

…rpc#12962)

Enables allowEmptyChecksums globally on Chocolatey and implements a
3-attempt retry loop for pkgconfiglite to prevent Windows CI failures
caused by transient network or SourceForge mirror errors. Even though
--allow-empty-checksums is passed to choco install, newer Chocolatey
versions do not propagate this CLI flag to the nested PowerShell
installer script (chocolateyInstall.ps1). The inner script fails when
downloading the binary from non-secure HTTP SourceForge mirrors unless
the allowEmptyChecksums feature is globally enabled via choco feature
beforehand.
This change also makes the script exit prematurely if pkg-config
installation still failed instead of continuing and failing later at the
linking step.

[Failed Kokoro build logs
example](https://btx.cloud.google.com/invocations/f43affbc-6ace-4158-bac4-86779b985b2f/targets/grpc%2Fjava%2Fmaster%2Fpresubmit%2Fwindows;config=default/log).

)

This fixes `XdsServerWrapper.shutdownNow()` silently doing nothing once
`shutdown()` had already been called, permanently hanging threads
blocked in `start()`. Previously they shared a single guard flag,
meaning whichever was called first made the other a complete no-op.

The fix gives `shutdownNow()`'s forceful-only work its own independent
guard, following the same two-guard pattern already used by
`ManagedChannelImpl`/`ServerImpl` in grpc-java core, so it always runs
exactly once regardless of call order.

Includes a regression test that reproduces the hang against the old code
and passes against the fix.

Signed-off-by: Martin Baillie <martin@baillie.id>

…#12972)

This PR implements stale_header_data caching and propagation for Route Lookup Service (RLS) in :grpc-rls, addressing gRPC Java does not handle RLS stale_header_data properly).

Netty/OkHttp/InProcess transports all ignore duplicate closes. We might
want to change that in the future, but for now let's just get them
aligned.