External Identity Provider

# External Identity Provider With `spec.auth.managedKeycloak: false` — the default — you create the OIDC objects yourself and reference them from the `Validator` resource. This works with any OIDC-compliant identity provider, including Okta, Microsoft Entra ID, Auth0, and Ping Identity. ## What to c