feat: Add experimental Entra user-info-fetcher backend

[maltesander]

Description

• adds expermimental Entra UIF backend

CRD

    pub struct EntraBackend {
        /// Hostname of the token provider, defaults to `login.microsoft.com`.
        #[serde(default = "entra_default_token_hostname")]
        pub token_hostname: HostName,

        /// Hostname of the user info provider, defaults to `graph.microsoft.com`.
        #[serde(default = "entra_default_user_info_hostname")]
        pub user_info_hostname: HostName,

        /// Port of the identity provider. If TLS is used defaults to `443`, otherwise to `80`.
        pub port: Option<u16>,

        /// The Microsoft Entra tenant ID.
        pub tenant_id: String,

        /// Use a TLS connection. Should usually be set to WebPki.
        // We do not use the flattened `TlsClientDetails` here since we cannot
        // default to WebPki using a default and flatten
        // https://github.com/serde-rs/serde/issues/1626
        // This means we have to wrap `Tls` in `TlsClientDetails` to use its
        // method like `uses_tls()`.
        #[serde(default = "default_tls_web_pki")]
        pub tls: Option<Tls>,

        /// Name of a Secret that contains client credentials of an Entra account with
        /// permissions `User.ReadAll` and `GroupMemberShip.ReadAll`.
        ///
        /// Must contain the fields `clientId` and `clientSecret`.
        pub client_credentials_secret: String,
    }

And the usage:

---
apiVersion: v1
kind: Secret
metadata:
  name: user-info-fetcher-client-credentials
stringData:
  clientId: foo
  clientSecret: bar
---
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
  name: opa
spec:
  image:
    productVersion: "1.0.1"
  clusterConfig:
    userInfo:
      backend:
        experimentalEntra:
          tenantId: foo-bar
          clientCredentialsSecret: user-info-fetcher-client-credentials
  servers:
    roleGroups:
      default: {}

[sbernauer]

Only minor comments.
Did not test it, you mentioned some Python script for simulating Entra?

[sbernauer]

Thanks for addressing the review!

[sbernauer]

Only one CRD change question left.
As this is a CRD change I think we should put it on the decisions board (even for experimental features)

[sbernauer]

LGTM, but I think this needs to go through the decision board