feat(sso): add OIDC SSO, existingSecret support, and optional console backend TLS

Summary

• Adds OIDC SSO to the init Job, next to the existing SAML path.
• Adds existingSecret for SAML and OIDC so secrets come from a pre-created Secret.
• Adds an opt-in console.backendTLS so Console emits an https redirect URI behind Istio.
• Everything defaults off; existing deployments render the same.

What changed

• New oidc values block, secret-oidc template, twistlock-oidc.sh, and init dispatch.
• SAML and OIDC init volumes are projected so existingSecret layers onto the chart Secret.
• groups[].authTypes lets one group record match SAML and OIDC.
• backendTLS points the route at 8083, adds a SIMPLE TLS DestinationRule, and excludes 8083 from the sidecar.

Upgrade Notices

• The SAML init volume changes from secret to projected; mounted path and file names are unchanged.
• No action needed at default values.

Linked Issue

• Closes issue.
• Builds on the init script pattern from !317 (merged) and !319 (merged).

Relevant logs/screenshots

• helm lint and stock helm template pass.
• helm unittest: 7 suites, 53 tests pass.
• bats: 21 pass.
• backendTLS render shows the VirtualService, DestinationRule, and NetworkPolicy on 8083 with no duplicates.