CNTRLPLANE-3306: add ExternalOIDCWithUpstreamParity e2e tests

[ehearne-redhat]

What this PR does / why we need it:

This change:

• Adds extensive testing for the ExternalOIDCWithUpstreamParity feature gate in control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth_test.go.

  • Includes testing the discoveryUrl, userValidationRules, claimValidationRules, and claimMappings.

• Tests the feature gate in a HyperShift cluster in test/e2e/external_oidc_test.go.

• Provides basic auth config testing of the feature gate in test/e2e/util/external_oidc.go .

• Configures the control plane operator feature sets in hypershift-operator.

  • This change is required as hypershift-operator re-uses control-plane-operator
    auth config validation code, which checks specifically for control-plane-operator
    feature set enablement.

    Without this change, if we try to enable feature set such as TechPreviewNoUpgrade,
    validation will fail as hypershift-operator does not configure control-plane-operator
    feature sets.

• Refactors existing tests to use a specified AuthConfig so that when the feature graduates it is easier to add the appropriate fields.

  • Tests can now interact with the keycloak instance via API so they can create
    new users/groups as needed for better testing coverage.

This change will allow us to test feature gates behind TechPreviewNoUpgrade and
others that are present in control-plane-operator, throughout HyperShift.

This should allow us to progress in promotion of the feature from TechPreview to GA.

Which issue(s) this PR fixes:

https://redhat.atlassian.net/browse/CNTRLPLANE-3306.

Allows us to progress in promotion of the ExternalOIDCWithUpstreamParity feature from TechPreview to GA.

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• New Features

  • Added External OIDC with upstream parity (feature-gated): supports differing discovery URLs, CEL-based claim→username/groups mappings, multiple claim validation rules, and user validation rules (reject system: usernames).

• Tests

  • Expanded unit and end-to-end tests covering discovery URL propagation, complex CEL claim mappings (nested/conditional/orValue/defaults/filter/map), claim and user validation behaviors, error case for empty CEL claim expression, and runtime username/groups resolution.