feat(keycloak): added Quarkus-style token URL helpers

[schronck]

Summary

• Added keycloak::login::token_url(host, realm) and master_token_url(host) returning {host}/realms/{realm}/protocol/openid-connect/token — the Keycloak 17+ (Quarkus distribution) default path layout without the legacy /auth context root.
• Kept client_credentials_url, password_url, and password_master_url unchanged so downstream services targeting Keycloak ≤ 16 (or 17+ started with --http-relative-path=/auth) keep working without code changes.

Why

Callers talking to a default Keycloak 17+ server (any modern Quarkus distribution) hit the legacy /auth/realms/... path and get back 404 {"error":"Unable to find matching target resource method"}. dec-party-manager users on Keycloak 26.3.3 are hitting this today. New helpers let services pick the path shape that matches their target deployment; old helpers stay around so existing services don't need to be touched.

Test plan

• cargo fmt -p keycloak -- --check
• cargo clippy -p keycloak --all-targets --all-features -- -D warnings
• cargo test -p keycloak
• cargo build --workspace