CNTRLPLANE-2589: Migrate test/e2e-oidc to OTE + fix Keycloak token expiration and PSA violations

This PR migrates test/e2e-oidc to OpenShift Tests Extension (OTE) framework with Ginkgo v2
integration and includes critical bug fixes from PR #859.

## OTE Migration Changes:

1. **Dual-Mode Pattern Implementation**
   - test/e2e-oidc/external_oidc.go: New Ginkgo test registration with complete OIDC test implementation
   - test/e2e-oidc/external_oidc_test.go: Simplified Go test wrapper for backward compatibility
   - cmd/cluster-authentication-operator-tests-ext/main.go: Add e2e-oidc import and fix serial suite qualifier

2. **Complete OIDC Authentication Test Workflow**
   - Implements full OIDC authentication test (not just preconditions)
   - OAuth/OIDC state validation
   - auth-config.json checks
   - JWT/JWKS verification with kube-apiserver authentication confirmation

3. **OTE Tags**
   - [OIDC][Serial][Disruptive] TestExternalOIDCWithKeycloak [Timeout:3h]

## Bug Fixes from PR #859:

1. **Keycloak Token Expiration (test/e2e/keycloak.go)**
   - Problem: Test discarded kcClient with 30-minute token, created new client with 5-minute token
   - Result: 401 errors in long-running tests
   - Fix: Reuse kcClient from AddKeycloakIDP() with extended token lifetime
   - Impact: Eliminates intermittent TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync failures

2. **PSA Audit Violations (test/library/client.go)**
   - Problem: WithPSaEnforcement() only set enforce label
   - Result: PSA audit/warn violations logged
   - Fix: Set all three PSA labels (enforce, audit, warn) for consistent behavior
   - Impact: Prevents Pod Security Admission audit log violations

## Library Enhancements:

- test/library/imagestream.go: ImportImageToImageStream() for importing external images
- test/library/idpdeployment.go: Configurable security context, deployPodWithImageStream()
- test/library/keycloakidp.go: ImageStream integration, restricted security context
- test/library/gitlabidp.go: ImageStream integration
- test/library/waits.go: Enhanced wait utilities accepting testing.TB
- test/library/client.go: TestNamespaceBuilder with PSA enforcement methods

## Vendor Dependencies:

- Added github.com/openshift/client-go/image/* for ImageStream client support

Co-Authored-By: Rohit Patil <ropatil@redhat.com>

Author: Rohit Patil

cmd/cluster-authentication-operator-tests-ext/main.go

@@ -17,6 +17,7 @@ import (
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption-kms"
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption-perf"
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption-rotation"
+	_ "github.com/openshift/cluster-authentication-operator/test/e2e-oidc"
 
 	"k8s.io/klog/v2"
 )
@@ -77,11 +78,15 @@ func prepareOperatorTestsRegistry() (*oteextension.Registry, error) {
 	// The following suite runs tests that must execute serially (one at a time)
 	// because they modify cluster-wide resources like OAuth configuration.
 	// Tests tagged with [Serial] and any of [Operator], [OIDC], [Templates], [Tokens] are included in this suite.
+	// Excludes [Disruptive] tests which run in the disruptive suite instead.
+	// ClusterStability set to Disruptive: OIDC tests temporarily put authentication operator
+	// in Degraded state during cleanup when IDP configuration is rolled back.
 	extension.AddSuite(oteextension.Suite{
-		Name:        "openshift/cluster-authentication-operator/operator/serial",
-		Parallelism: 1,
+		Name:             "openshift/cluster-authentication-operator/operator/serial",
+		Parallelism:      1,
+		ClusterStability: oteextension.ClusterStabilityDisruptive,
 		Qualifiers: []string{
-			`name.contains("[Serial]") && (name.contains("[Operator]") || name.contains("[OIDC]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
+			`name.contains("[Serial]") && !name.contains("[Disruptive]") && (name.contains("[Operator]") || name.contains("[OIDC]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
 		},
 	})