Function validate_source_credentials 

pub fn validate_source_credentials<F>(
    config: &RouterConfig,
    requires_credential: F,
) -> Result<(), CredentialGraphError>
where
    F: FnMut(&str) -> Option<CredentialRef>,

Validate the source-credential graph defined by config and the requires_credential lookup for each defined source.

requires_credential maps a source name to its SecretSource::requires_credential return value. The router constructs sources first, then passes |name| sources[name].requires_credential() here. Tests stub the function with a static map.

Returns Ok(()) when every source either has no credential, is satisfied by a sentinel, or routes through exactly one credential-free source. Otherwise returns the appropriate CredentialGraphError.