feat(oidc): add key-id config field for stable kid in private_key_jwt assertions

[coopernetes]

Background

When private-key-path is configured, SecurityConfig.loadRsaKey currently sets a random UUID as kid in the JWT assertion header when cert-path is not provided. This works for Entra ID (which matches on x5t, added in #149) but is broken for providers that match on kid — Keycloak, Okta, Auth0, Dex — because the kid changes on every server restart and no longer matches the kid registered with the provider's JWKS.

Proposed Fix

Add an optional key-id field to OidcAuthConfig. Precedence in loadRsaKey:

1. cert-path set → compute and set x5t (Entra ID)
2. key-id set → use as explicit kid
3. Neither → random UUID kid (backward compat only; suitable for providers that accept any kid)

auth:
  oidc:
    private-key-path: /run/secrets/gitproxy-oidc-key.pem
    key-id: my-registered-kid   # must match the kid in the JWKS registered with the provider

Affected Providers

• Keycloak — registers a JWKS with a fixed kid; assertion kid must match
• Okta — same
• Auth0 — same
• Dex — same
• Entra ID — unaffected (uses cert-path / x5t)