Add OIDC SSO authentication bridge

[miki3421]

Summary

This PR adds an OIDC-based authentication bridge to openserverless-admin-api, enabling Keycloak or another OIDC provider to authenticate users and map them to OpenServerless namespaces.

Changes

• Add OIDC JWT validation through JWKS.
• Add deterministic SSO username to namespace mapping.
• Add OIDC login endpoint compatible with the existing OpenServerless login response shape.
• Add backend-managed OIDC device-flow endpoints.
• Support optional namespace auto-provisioning through WhiskUser.
• Preserve existing username/password authentication behavior.
• Add unit tests for token validation, namespace mapping, OIDC login, and device flow.

Validation

• uv run python -m unittest discover tests
• Result: 20 tests passed.

Notes

This keeps OpenWhisk technical authentication based on uuid:key unchanged. OIDC is introduced at the Admin API boundary as a bridge between external identity and existing OpenServerless namespace credentials.