Add OIDC custom claims configuration

[joe-armstrong]

Adds spec.config.auth.oidc.customClaims so Bindplane can read an IdP that already uses its own claim names or group naming scheme, instead of making the IdP match Bindplane defaults.

Two sets of fields, all optional:

Claim names to read on the ID token:

Field	Env var	Default
groups	BINDPLANE_OIDC_CUSTOM_CLAIMS_GROUPS	groups
groupIds	BINDPLANE_OIDC_CUSTOM_CLAIMS_GROUP_IDS	group_ids
roles	BINDPLANE_OIDC_CUSTOM_CLAIMS_ROLES	roles
organizationAdmin	BINDPLANE_OIDC_CUSTOM_CLAIMS_ORGANIZATION_ADMIN	bindplane_org_admin
projects	BINDPLANE_OIDC_CUSTOM_CLAIMS_PROJECTS	bindplane_projects
defaultRole	BINDPLANE_OIDC_CUSTOM_CLAIMS_DEFAULT_ROLE	bindplane_default_role

Strings to match inside the groups and roles claims:

Field	Env var	Default
orgAdminGroupName	BINDPLANE_OIDC_CUSTOM_CLAIMS_ORG_ADMIN_GROUP_NAME	bindplane-org-admin
projectsGroupPrefix	BINDPLANE_OIDC_CUSTOM_CLAIMS_PROJECTS_GROUP_PREFIX	bindplane-projects-
adminGroupName	BINDPLANE_OIDC_CUSTOM_CLAIMS_ADMIN_GROUP_NAME	bindplane-admin
userGroupName	BINDPLANE_OIDC_CUSTOM_CLAIMS_USER_GROUP_NAME	bindplane-user
viewerGroupName	BINDPLANE_OIDC_CUSTOM_CLAIMS_VIEWER_GROUP_NAME	bindplane-viewer

An env var is only set when the field is populated, so anything left unset falls through to the server default. No validation was added — every field is a free-form string with no cross-field constraints.

The public OIDC docs page lists the YAML keys but not the env vars, so the names above were taken from the server config bindings and should be double checked in review.

Custom claims need Bindplane server v1.100.2 or later. The operator default is currently 1.98.1, so anyone using the default image needs to override spec.version for this to do anything. Earlier servers ignore the env vars.

Example:

spec:
  config:
    auth:
      type: oidc
      oidc:
        issuer: https://accounts.example.com
        scopes: [openid, profile, email]
        clientIDSecretRef:
          name: oidc-secrets
          key: client-id
        clientSecretSecretRef:
          name: oidc-secrets
          key: client-secret
        customClaims:
          groups: user_groups
          orgAdminGroupName: acme-org-admin
          projectsGroupPrefix: acme-projects-

Second commit is unrelated to the feature but needed for the rc. Goreleaser had no prerelease setting, so it defaulted to publishing every tag as a full release marked Latest. That means 0.1.0-beta.0 and 0.1.0-beta.1 each displaced the stable release at the time. Set prerelease: auto and gated make_latest on it. Verified on 0.2.0-rc.1: the release shows as a prerelease and 0.1.0 is still Latest.

Docs updated: configuration.md (new Custom claims section plus TOC), security.md (noted these are claim names, not credentials, so no SecretRef variant), api.md regenerated.

Tests cover the helper directly (all fields, partial, empty, nil) and that custom claims reach the full OIDC env var set. make test, make lint, and make gosec all pass.

Released as a prerelease for testing: ghcr.io/observiq/bindplane-operator:0.2.0-rc.1