ci(auth_v2): run the proxy auth_v2 suite with xmlsec1 in the proxy-auth shard

The proxy/auth_v2 tests were not picked up by any shard because the proxy-auth path list matched the literal proxy/auth directory, not its sibling. Add the path and install xmlsec1 so the pysaml2 signing tests run rather than skip; the install is gated behind a new optional apt-packages input so the other shards are unchanged.

.github/workflows/_test-unit-base.yml

@@ -36,6 +36,11 @@ on:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: true
         type: string
+      apt-packages:
+        description: "Optional space-separated apt packages installed before dependencies (e.g. xmlsec1 libxmlsec1-dev for the SAML signing tests)"
+        required: false
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -71,6 +76,12 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-uv-
 
+      - name: Install system packages
+        if: ${{ inputs.apt-packages != '' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ${{ inputs.apt-packages }}
+
       - name: Install dependencies
         run: |
           uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

.github/workflows/test-unit-proxy-auth.yml

@@ -21,7 +21,8 @@ jobs:
   proxy-auth:
     uses: ./.github/workflows/_test-unit-base.yml
     with:
-      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/auth_v2 tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      apt-packages: "xmlsec1 libxmlsec1-dev"
       workers: 2
       reruns: 2
       artifact-name: proxy-auth