attest jira: --jira-project-key rejects a comma-separated list written with spaces

[mbevc1]

Problem

--jira-project-key is a StringSliceVar (cmd/kosli/attestJira.go:260), and pflag splits those with encoding/csv, which never trims (readAsCSV in pflag/string_slice.go; pflag never sets TrimLeadingSpace). So a list written the way most people type one arrives with the whitespace attached, and validateJiraProjectKeys rejects the padded fragment because jiraProjectKeyRegexp is ^[A-Za-z][A-Za-z0-9_]{1,9}$.

Reproduction

Correction. The first version of this issue said this table was "verified against a binary built from 20260820_perf_improvement". It was not — the behaviour was asserted, not run. The table below is real output, captured from binaries built before and after the fix, using --dry-run against a throwaway git repo.

input	before	after
--jira-project-key "ABC,DEF"	ok	ok
--jira-project-key "ABC, DEF"	invalid Jira project keys: [ DEF]	ok
--jira-project-key " ABC"	invalid Jira project keys: [ ABC]	ok
--jira-project-key "EX, ABC"	invalid Jira project keys: [ ABC]	ok
--jira-project-key "ABC,"	was given an empty value	was given an empty value
--jira-project-key "ABC,,DEF"	was given an empty value	was given an empty value
--jira-project-key "ABC, "	invalid Jira project keys: [ ]	invalid Jira project keys: []

A second correction: this issue originally claimed a trailing comma fails with invalid Jira project keys: []. It does not. "ABC," is refused earlier, while pflag is still parsing, by the repo-wide empty-element rule in cmd/kosli/nonEmptyValue.go — with clearer wording than this validator could give it. So trailing commas were already handled sensibly; only the whitespace cases were broken.

Fix

Trim the keys in place before validating, so one canonical key reaches both validateJiraProjectKeys and jira.FindJiraIssueKeys, rather than each trimming separately and having to agree. internal/jira's makeJiraIssueKeyPattern already trims what it interpolates (landed in #1114); that becomes belt-and-braces instead of the only thing standing between a padded key and a pattern matching " ABC-123".

Deliberately out of scope

A whitespace-only element slips past the empty-element rule, since " " is not "", so --jira-project-key "ABC, " still fails — now displayed as an empty key rather than as a space. Teaching that repo-wide rule to treat whitespace as empty would change behaviour on all 165 flags and wants its own audit; #1099 flagged the same gap.

Effort

Small, as estimated: 1 helper (5 lines) + 1 call site, a 7-case unit table, 2 CLI suite cases. No docs regeneration, since the flag help text is unchanged. No CHANGELOG.md in this repo — releases run through GoReleaser off conventional commits, so the commit message is the changelog entry, which corrects this issue's original "needs a changelog entry" line.

Origin

Spun out of a review thread on #1114: #1114 (comment)