feat(keycloak): support service account client role mappings

[evanshortiss]

The PR adds one optional field (serviceAccountRoles) to the ocp4_workload_authentication_keycloak_clients variable.

Problem

When you create a Keycloak client with serviceAccountsEnabled: true, Keycloak automatically creates a service account user — but the realm import template has no way to assign client roles to it. This matters for plugins like the RHDH keycloakOrg provider, which needs query-users, view-users, and query-groups on the realm-management client.

Change

If a client entry includes a serviceAccountRoles dict, the template adds the service account user to the realm import's users section with the specified clientRoles. If the field isn't defined, behavior is unchanged.

Usage:

  ocp4_workload_authentication_keycloak_clients:
  - clientId: backstage-plugin
    secret: "{{ some_secret }}"
    serviceAccountsEnabled: true
    serviceAccountRoles:
      realm-management:
        - query-users
        - view-users
        - query-groups