feat: Add experimental Entra user-info-fetcher backend

[maltesander]

Description

• adds expermimental Entra UIF backend

CRD

pub struct EntraBackend {
    /// Hostname of the token provider, defaults to `login.microsoft.com`.
    #[serde(default = "entra_default_token_hostname")]
    pub token_hostname: HostName,

    /// Hostname of the user info provider, defaults to `graph.microsoft.com`.
    #[serde(default = "entra_default_user_info_hostname")]
    pub user_info_hostname: HostName,

    /// Port of the identity provider. If TLS is used defaults to `443`, otherwise to `80`.
    pub port: Option<u16>,

    /// The Microsoft Entra tenant ID.
    pub tenant_id: String,

    /// Use a TLS connection. Should usually be set to WebPki.
    // We do not use the flattened `TlsClientDetails` here since we cannot
    // default to WebPki using a default and flatten
    // https://github.com/serde-rs/serde/issues/1626
    // This means we have to wrap `Tls` in `TlsClientDetails` to use its
    // method like `uses_tls()`.
    #[serde(default = "default_tls_web_pki")]
    pub tls: Option<Tls>,

    /// Name of a Secret that contains client credentials of an Entra account with
    /// permissions `User.ReadAll` and `GroupMemberShip.ReadAll`.
    ///
    /// Must contain the fields `clientId` and `clientSecret`.
    pub client_credentials_secret: String,
}

And the usage:

---
apiVersion: v1
kind: Secret
metadata:
  name: user-info-fetcher-client-credentials
stringData:
  clientId: foo
  clientSecret: bar
---
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
  name: opa
spec:
  image:
    productVersion: "1.0.1"
  clusterConfig:
    userInfo:
      backend:
        experimentalEntra:
          tenantId: foo-bar
          clientCredentialsSecret: user-info-fetcher-client-credentials
  servers:
    roleGroups:
      default: {}

[sbernauer]

Only minor comments.
Did not test it, you mentioned some Python script for simulating Entra?

[sbernauer]

Thanks for addressing the review!

[sbernauer]

Only one CRD change question left.
As this is a CRD change I think we should put it on the decisions board (even for experimental features)

[sbernauer]

LGTM, but I think this needs to go through the decision board

[lfrancke]

Could you add a link to the docs and release notes please?

[maltesander]

Docs: https://docs.stackable.tech/home/nightly/opa/usage-guide/user-info-fetcher/#backend-entra
Release Snippet: The user-info-fetcher backend now supports fetching user groups from Microsoft Entra experimentally.