[bug-hunter] Okta OAuth2 with jwk_json fails on first authenticated request

## Impact
`x-pack/filebeat` Okta OAuth2 authentication with `jwk_json` is broken in `main`. Configuration validates and `fetchOktaOauthClient` returns successfully, but the first authenticated API request fails, so entityanalytics collection cannot proceed.

## Reproduction Steps
1. Create `x-pack/filebeat/input/entityanalytics/provider/okta/zz_bug_repro_test.go` with:

```go
package okta

import (
"context"
"encoding/json"
"net/http"
"net/http/httptest"
"testing"

"github.com/elastic/beats/v7/libbeat/common"
"github.com/stretchr/testify/require"
)

func TestReproJWKJSONOAuthClientRequestFails(t *testing.T) {
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path == "/oauth2/v1/token" {
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(map[string]any{
"access_token": "mock",
"token_type": "Bearer",
"expires_in": 3600,
})
return
}

w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte(`{"ok":true}`))
}))
defer srv.Close()

cfg := &oAuth2Config{
ClientID: "test-client",
Scopes: []string{"okta.users.read"},
TokenURL: srv.URL + "/oauth2/v1/token",
OktaJWKJSON: common.JSONBlob(testOktaJWKJSON),
}

oauthClient, err := cfg.fetchOktaOauthClient(context.Background(), srv.Client())
require.NoError(t, err, "fetchOktaOauthClient should succeed with valid jwk_json")

resp, err := oauthClient.Get(srv.URL + "/api")
require.NoError(t, err, "oauth client request should succeed with valid jwk_json authentication")
require.Equal(t, http.StatusOK, resp.StatusCode, "oauth client should reach the API endpoint")
}
```

2. Run:

```bash
go test ./x-pack/filebeat/input/entityanalytics/provider/okta -run TestReproJWKJSONOAuthClientRequestFails -count=1
```

## Expected vs Actual
**Expected:** With valid `jwk_json`, authenticated requests succeed.

**Actual:** Request fails immediately:

```text
--- FAIL: TestReproJWKJSONOAuthClientRequestFails (0.00s)
zz_bug_repro_test.go:42:
Error Trace: /home/runner/work/beats/beats/x-pack/filebeat/input/entityanalytics/provider/okta/zz_bug_repro_test.go:42
Error: Received unexpected error:
Get "(127.0.0.1/redacted) error generating Okta JWT: error decoding JWK: unexpected end of JSON input
Test: TestReproJWKJSONOAuthClientRequestFails
Messages: oauth client request should succeed with valid jwk_json authentication
FAIL
FAIL github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/okta 0.007s
FAIL
```

## Failing Test
The complete failing test is shown in Reproduction Step 1.

## Evidence
- `x-pack/filebeat/input/entityanalytics/provider/okta/oauth2.go:96-100` generates initial JWT from `o.OktaJWKJSON`.
- `x-pack/filebeat/input/entityanalytics/provider/okta/oauth2.go:116-123` stores `oktaJWK: jwkData` in `oktaTokenSource`.
- `x-pack/filebeat/input/entityanalytics/provider/okta/oauth2.go:84` declares `jwkData []byte` but it is only populated for `OktaJWKFile` (`oauth2.go:87-92`).
- In `OktaJWKJSON` mode, `jwkData` stays empty, and `oktaTokenSource.Token` calls `generateOktaJWT(ts.oktaJWK, ts.conf)` (`oauth2.go:202`), which fails at `json.Unmarshal(oktaJWK, &jwkData)` (`oauth2.go:227`) with `unexpected end of JSON input`.

This is distinct from the earlier PEM/file issue: it affects the `jwk_json` path after the recent OAuth2 refresh fix.

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#50406](https://github.com/elastic/beats/pull/50406) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/beats/actions/runs/26224713139)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 28, 2026, 12:18 PM UTC