feat: add namespaced OIDC client XR

[patrickleet]

Summary

• add a namespaced OIDCClient XR for exact-redirect Zitadel web applications
• compose ESO bootstrap credentials, a namespaced ProviderConfig, and the OIDC application lifecycle
• publish the generated client credentials into the consumer namespace
• add render, readiness, schema, and workflow validation coverage

Validation

• up project build
• first-iteration composition render: Ready=False until dependencies exist
• observed-resource render: Ready=True with typed application/client IDs
• production API server-side dry-run for XRD, Composition, ExternalSecret, ProviderConfig, and Oidc
• actionlint
• git diff --check

Local up test execution parsed both KCL tests but the Dory container wait endpoint timed out; GitHub CI runs the standard Linux harness.

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/auth-stack:pr-26-bbcb91eec253b73cb7d833fdbf1bbf6614ef5ffd

View Package