Support OIDC discovery via optional configuration_uri on chains and default_oidc_config

Feature Request

Why

authservice can already discover a provider's endpoints from its .well-known/openid-configuration document, but the chart doesn't expose that. Today a non-Keycloak provider means setting authorization_uri, token_uri, and jwks_uri by hand and keeping them current. Add an optional configuration_uri value on chains and default_oidc_config to point at the discovery endpoint instead: one URL rather than three. This is a convenience for providers like DAF ICAM, not a new capability; the explicit-URI path already works.

Proposed Solution

Handle configuration_uri in secret.yaml at two levels: default_oidc_config (from global.configuration_uri) and per-chain oidc_override (from a chain's configuration_uri). When it's set, emit only that field and drop the authorization_uri/token_uri/jwks_fetcher block. The binary resolves the rest at startup.

Precedence, most specific first: explicit authorization_uri plus token_uri, then configuration_uri, then the existing oidc.host/realm Keycloak shortcut. The field is optional, so nothing changes for anyone not using it. Leave it unset and the rendered output is identical to today on both the explicit-URI and Keycloak paths. Tests cover the chain-level, precedence, and default_oidc_config cases.