Managed Keycloak

# Managed Keycloak Let CAT-BM provision the OIDC clients, scopes, and users a validator needs. With `spec.auth.managedKeycloak: true`, the operator provisions everything the validator's components need inside an existing Keycloak realm, on the validator's first reconcile. ## Configuration At the pla