fix(core/http): fix AWS ALB cert decoding and nil error logging

[Abhishek00810]

Description

What does this PR do?

This PR fixes a regression where client certificates forwarded by AWS ALB failed to parse due to incorrect URL decoding, and fixes a nil pointer error in the associated logging.

1. The Parsing Bug (AWS ALB)

• Issue: AWS ALB sends the X-Amzn-Mtls-Clientcert header URL-encoded but leaves + characters unescaped (literal +). Vault was using url.QueryUnescape, which converts + to space, corrupting the Base64 payload (e.g., abc+def becomes abc def).
• Fix: Switched to url.PathUnescape. This correctly decodes percent-encoding while preserving literal + characters, matching AWS ALB behavior.

2. The Logging Bug (Nil Error)

• Issue: The existing code tried to wrap err when pem.Decode failed. However, the signature func Decode(data []byte) (p *Block, rest []byte) does not return an error.
• Result: The variable err was nil in that scope, causing logs to print failed to convert ...: %!w(<nil>).
• Fix: Added an explicit errors.New("pem decode failed") to provide a readable error message when the block is nil.

Verification:

• Added a reproduction test case in vault/http/forwarded_for_test.go that manually constructs a certificate string with literal + characters to simulate AWS ALB.
• Verified the test fails with QueryUnescape and passes with PathUnescape.

Fixes #31728

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• Jira: If this change has an associated Jira, it's referenced either in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.

[vercel]

@Abhishek00810 is attempting to deploy a commit to the HashiCorp Team on Vercel.

A member of the Team first needs to authorize it.

[Abhishek00810]

@stevendpclark can you look into this, I think that can break in production if issue is valid, let me know what you think.

[hc-github-team-secure-vault-core]

Copy workflow completed!

From	To	Skipped Merge Commits	Error
hashicorp/vault#31740	hashicorp/vault-enterprise#16587	0

[hc-github-team-secure-vault-core]

Copy pull request failed!

Origin Pull Request	Copied Pull Request	Commit SHA	Error
#31740	https://github.com/hashicorp/vault-enterprise/pull/16587	https://github.com/hashicorp/vault-enterprise/commit/46ba6d5f1fb5b700225765627dfce3d3ed88d440	PATCH https://api.github.com/repos/hashicorp/vault/issues/31728: 403 Resource not accessible by personal access token []
	Closed Issues	#31728
Error: PATCH https://api.github.com/repos/hashicorp/vault/issues/31728: 403 Resource not accessible by personal access token []

[ncabatoff]

Hi @Abhishek00810, thanks for the contribution and for the detailed explanation of the issue. I've merged it as part of a PR in the enterprise version of this repo, with some small changes. It will be available in not the upcoming release, but the one after.