feat: add support for public clients and disabling standard auth flow

[Racer159]

Description

This enables support for public clients and allows disabling the standard flow in a client to fully support the OAuth device flow.

You can see an example of how this would be implemented here: https://github.com/defenseunicorns/uds-package-sigstore/pull/19/files#diff-84cee30d5e16b64372e9b71dc11e8d2643001f0fdd881c71f76768372ed18edeR10

Related Issue

Fixes #509

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[Racer159]

(note - though not directly required this also makes redirectUris optional since they are not needed for device flow clients and are optional in the KC api: https://www.keycloak.org/docs-api/21.1.1/rest-api/#_clientrepresentation)

[Racer159]

here is what this looks like for sigstore when tested in that repo:

[bburky]

This allows disabling standardFlowEnabled, but doesn't seem to enable the device flow? Or how are you doing that?

publicClient is a risky but does make sense for certain scenarios like device flow. I'd kind of like to protect our usual configurations to prevent a misconfiguration of incorrectly using publicClient, but I'm not sure how to do that. If nothing else we should have a validation rule that you don't use publicClient: true with secretName, secretTemplate, secret, enableAuthserviceSelector, protocol: saml (might be meaningless on SAML, unsure).

Ideally using a public client is like a policy violation that somehow has to actually be marked as allowed. I don't think uds-operator's own policies really map well to this though. If Lula(?) was ready, I guess we could use it to detect all Packages with public clients.

For the device flow, I think redirectUris and webOrigins don't matter/aren't used? I think they're always ignored if standardFlowEnabled: false? I just want to make sure that there's no way to use the normal flow on the client intended for device flow, if we need to throw an error on setting redirectUris and webOrigins with standardFlowEnabled: false too.

[Racer159]

Enabling the device flow is an attribute you add to the client: https://github.com/defenseunicorns/uds-package-sigstore/pull/19/files#diff-84cee30d5e16b64372e9b71dc11e8d2643001f0fdd881c71f76768372ed18edeR13

The redirectUris, post logout redirectUris, and webOrigins are disabled when standard flow is disabled.

[Racer159]

We could disallow a public client for anything but device flow attributed standardAuthFlow disabled clients

[bburky]

This is fine I guess, the allowed configurations are limited enough that it should never be possible to use with a web client.