Support private_key_jwt for Client Secret Rotation with Grace Periods

[vriesdemichael]

Context

The current implementation of client secret rotation uses the standard client-secret authenticator. This method does not support history or grace periods; rotation is atomic.

Proposal

Add support for the private_key_jwt authentication method in the Keycloak Operator.

Benefits

• True Grace Periods: Keycloak supports multiple active public keys for a client (JWKS).
• Zero-Downtime: The operator can rotate the key pair, uploading the new public key while the old one remains valid for a configured grace period.

Requirements

• Update KeycloakClient CRD to support private_key_jwt.
• Implement RSA Key Pair generation in the Operator.
• Manage JWKS in Keycloak.
• This requires application-side changes to sign JWTs instead of using a static secret string.