Predefined providers (uitrusting/v1) + roles claim

[KrisSimon]

Stacked on #98 (feature/provider-tenant-info) — the generated Uitrusting script sends credentials.tenant.name, which that PR adds. Review/merge #98 first; base will retarget to main afterwards.

Summary

Lets a tenant declare a predefined provider instead of hand-writing the JavaScript, and adds a roles array claim to the token.

Predefined providers

providers entries can now be either a raw script (unchanged) or an object:

providers:
  - |
    class UserLoginProvider { … }   # raw script — still supported
  - type: uitrusting/v1             # predefined provider
    url: uitrusting.acme.svc
    token: "…"                      # optional; sent as X-Internal-Token

A predefined provider is expanded internally to a generated UserLoginProvider (UitrustingProviderScript) that:

• POST {url}/verify with { tenant, username, password } (tenant name from the login),
• sends X-Internal-Token only when token is configured (Uitrusting's INTERNAL_AUTH_TOKEN),
• maps the response { known, valid, subject, roles, scopes, profile } onto canLogin (known && valid), the committed subject, role/roles, scopes, and userProfile.

TenantProvider is a Codable union (string | object) and ExpressibleByStringLiteral, so existing YAML/Swift keep working. TenantSpec.providerScripts expands the list; the four provider call sites use it.

Roles claim

Adds an optional roles: [String] claim alongside the existing single role (which mirrors the primary/first role). Threaded from a provider's roles getter (getRoles()) through the login, activate, and password/refresh token flows. Omitted from the token when the provider only exposes a single role, so existing tokens are unchanged.

CRD

providers items now accept a string or an object (x-kubernetes-preserve-unknown-fields).

Tests & verification

• New: TenantProviderTest (union decode/encode + expansion), UitrustingProviderScriptTest (endpoint/scheme/token header + the generated JS loads as valid script), ProviderRolesTest (getRoles() + roles claim round-trip).
• Full suite: 860 tests pass; ./tooling.sh lint 0 violations.

Notes / decisions

• Request contract confirmed with you: POST {url}/verify, body {tenant, username, password} (plain password; Uitrusting hashes internally), optional shared token.
• No UserValidationProvider is generated — token refresh re-validation would need a username-only Uitrusting lookup, which isn't defined yet. A predefined-only tenant behaves like any login-only tenant (governed by ALLOW_MISSING_PROVIDERS). Easy follow-up once a lookup endpoint exists.
• Not run: full e2e (needs a kind cluster).