Preserve platform auth for OIDC policy updates

[chen21019]

Summary

• preserve the caller PastureStack authorization for administrative POST /v1-auth/config requests
• retain external IdP access tokens for read-only authentication config and identity enrichment
• normalize generated Bearer headers and add route-selection regression coverage
• bump the immutable engine release line to 0.183.309 and update compatibility/release documentation

Root cause

The authentication proxy replaced the platform operator credential with the external provider access token. Authentication Service then could not consume the actor-bound MFA policy ticket through the control-plane API, so a confirmed unrestricted policy save was rejected before ticket consumption.

Validation

• GenericWhitelistedProxyTest: 15/15 passed on the 35-module Maven reactor
• scripts/check-pasturestack-source: passed with auth_config_proxy_identity=caller-platform-credential
• all POMs parse and contain no stale 0.183.308 project version
• git diff --check passed

Server release integration will additionally exercise the public /v1-auth/config boundary; direct port 8090 validation is explicitly insufficient.