feat: add optional configuration_uri for OIDC endpoint discovery

General MR

Summary

• Add an optional configuration_uri value on chains and default_oidc_config. When set, authservice discovers the authorization, token, and jwks endpoints from the provider's .well-known/openid-configuration document at runtime, so a non-Keycloak provider takes one discovery URL instead of three endpoints set by hand (which also avoids drift when the provider rotates them). The explicit authorization_uri/token_uri path is unchanged.
• Precedence, most specific first: explicit authorization_uri plus token_uri, then configuration_uri, then the existing oidc.host/realm Keycloak shortcut. The field is optional, so nothing changes when it's unset.
• Make global.authorization_uri and global.token_uri real empty-string keys instead of commented placeholders, matching the sibling jwks, jwks_uri, and certificate_authority keys. helm-docs now gives each its own Values row instead of folding them into global.client_id. Empty string is falsy in the templates, so rendering doesn't change.
• Add unit tests for chain-level discovery, explicit-URI precedence, and default_oidc_config discovery.

Relevant logs/screenshots

Unit tests (all suites):

Charts:      1 passed, 1 total
Test Suites: 6 passed, 6 total
Tests:       36 passed, 36 total

Default render is unchanged (empty global URIs are falsy, Keycloak shortcut still used):

"authorization_uri": "https://login.dso.mil/auth/realms/baby-yoda/protocol/openid-connect/auth",
"token_uri": "https://login.dso.mil/auth/realms/baby-yoda/protocol/openid-connect/token",

With global.configuration_uri set, discovery is emitted and the explicit URIs are omitted:

"configuration_uri": "https://idp.example.com/.well-known/openid-configuration",

Linked Issue

issue

Upgrade Notices

N/A