Fixes #39712 - Add native OpenID Connect authentication

[jakduch]

What this changes

This adds native multi-provider OpenID Connect authentication to Foreman without requiring Apache/mod_auth_openidc.

OIDC providers are managed as authentication sources and can be added or changed without restarting Foreman. The implementation includes:

• Authorization Code flow with state, nonce and PKCE S256;
• discovery or manually configured provider endpoints;
• confidential and public clients with encrypted client secrets and custom CA support;
• strict issuer, audience, authorized-party, time, nonce, signature and at_hash validation;
• separate provider identities keyed by provider and stable subject;
• safe opt-in linking through a unique verified email address;
• automatic provisioning, taxonomy assignment and user attribute updates;
• group synchronization through existing external user groups;
• self-service identity linking and administrator management;
• RP-initiated logout;
• provider management and connection testing in the UI and API;
• optional API bearer authentication for pre-linked identities with a dedicated API audience.

Provider access, refresh and ID tokens are not persisted. Foreman keeps its own authenticated session after the callback.

Compatibility

The implementation uses Foreman's existing rest-client and jwt dependencies. It does not add another OIDC client gem or change Faraday constraints, so the shared Foreman and Katello Bundler graph remains compatible.

The existing global OIDC bearer-token validator and Apache SSO integration remain available. The developer documentation includes Keycloak configuration and a migration path from Apache-based OIDC.

Testing

• LoginPage Jest tests: 5 passing
• ESLint for the changed LoginPage files
• Stylelint for the changed stylesheet
• Ruby syntax checks for the changed Ruby and RABL files supported by the local Ruby version
• staged diff and whitespace checks

The complete Ruby test matrix will run in CI because this local checkout does not have the full Foreman bundle installed.

Related to #28345 and supersedes the incomplete proof of concept in #10797.

Assisted-By: Codex 5.6 Sol High

[jakduch]

CI was retriggered with a content-identical commit (tree 142c9ce1c5686018450c2bd4696370bc4a46f196). The same unrelated HostgroupJSTest#test_0002_creates a hostgroup with provisioning data timed out again, but the failure moved from Ruby 3.3 in the previous run to Ruby 3.0 in the rerun, while the other Ruby matrix passed each time. The exact same flaky failure also appeared on unrelated #10764. This looks like an existing Capybara/integration test flake rather than a regression in the OIDC changes.

Previous Ruby 3.3 failure: https://github.com/theforeman/foreman/actions/runs/33276404697/job/99163990465
Current Ruby 3.0 failure: https://github.com/theforeman/foreman/actions/runs/33322633973/job/99287333592
Current Ruby 3.3 success: https://github.com/theforeman/foreman/actions/runs/33322633973/job/99287333585