feat: add OIDC auth support for osctrl-admin

[jan-krueger]

This PR adds OIDC (OpenID Connect) authentication as a new auth method for osctrl-admin. It partially closes #800

• auto-discovers endpoints from the issuer's .well-known/openid-configuration
• includes JIT user creation
• allows to restrict access to specific groups (not the most flexible but probably sufficient for most use-cases)

I've tested this with a local Keycloak instance.

[Copilot]

Pull request overview

Adds OIDC (OpenID Connect) as an authentication option for the osctrl-admin service, including issuer discovery, login/callback handlers, and JIT user provisioning with optional group-based access restrictions (aligning with #800’s request for OIDC support).

Changes:

• Introduce OIDC configuration schema + CLI flags/env vars, and wire it into admin config loading.
• Implement OIDC Authorization Code flow (optionally with PKCE), session creation, JIT user provisioning, and required-group gating.
• Add example OIDC configuration to the shipped deploy/config/admin.yml.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/config/types.go	Adds oidc section to admin config types and defines YAMLConfigurationOIDC.
pkg/config/flags.go	Adds OIDC-related CLI flags/env vars and attaches them to admin flag initialization.
cmd/admin/utils.go	Wires loaded YAML oidc config into ServiceParameters.
cmd/admin/main.go	Enables auth: oidc, initializes OIDC runtime, and registers OIDC routes.
cmd/admin/auth.go	Treats OIDC like DB auth for session-based auth checks.
cmd/admin/oidc.go	Implements OIDC login/callback/logout handlers, PKCE/state cookie handling, group checks, and JIT provisioning.
deploy/config/admin.yml	Documents/example configuration for OIDC auth.
go.mod / go.sum	Adds OIDC dependencies (go-oidc, oauth2, go-jose) and tidies module sums.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jan-krueger]

I've addressed the issues the bot spotted. Let me know if there is anything else you want me to address. :)