fix(auth): remove check restricting empty UID to handle kube:admin bootstrap user scenario

[rohanKanojia]

What does this PR do?

Fixes a regression introduced in #134 where web-terminal-exec rejects users with an empty Kubernetes UID, breaking web terminal auth for bootstrap kube:admin on clusters where oc whoami returns kube:admin.

#134 added SelfSubjectReview (needed for WTO-399 / external auth), but also added:

if review.Status.UserInfo.UID == "" {
    return "", fmt.Errorf("SelfSubjectReview returned empty UID")
}

Before #134, we already allowed empty UIDs, the User API path simply returned string(userInfo.GetUID()) with no blank check, so "" was valid and "" == "" auth succeeded for kube:admin (see openshift/origin#24950).

After #134, the new checks fail auth before we reach that comparison.

This PR restores that behavior with two changes:

1. Reordered UID lookup — try the OpenShift User API first, then fall back to SelfSubjectReview only
   when the User API is unavailable (e.g. BYO external authentication without user.openshift.io). This
   matches pre-fix(auth): resolve user UID via SelfSubjectReview for external authentication #134 ordering and lets kube:admin resolve via the User API before hitting the stricter
   fallback path.

2. Partial empty-UID check — allow an empty UID from the OpenShift User API (valid for kube:admin /
   kubeadmin when AUTHENTICATED_USER_ID is also empty), but keep the empty-UID rejection on the
   SelfSubjectReview fallback path so external-auth users without a UID still fail clearly rather than
   silently authenticating.

What issues does this PR fix or reference?

fixes issue found during pre-release-testing, kube:admin users were unable to open terminal

Is it tested? How?

Verified on aws clusterbot CI cluster (oc whoami = kube:admin):

SelfSubjectReview: userInfo.username=kube:admin, no uid field
User API (~): metadata.name=kube:admin, no metadata.uid

Bootstrap kube:admin has no Kubernetes UID.

1. Deploy WTO with current staging RC
2. Open the web terminal as kube:admin
3. You'll see error
4. Patch Web Terminal Exec template with this image based on this PR

oc patch devworkspacetemplate web-terminal-exec -n "${NS:-openshift-operators}" --type='json'  -p='[{"op":"replace","path":"/spec/components/0/container/image","value":"docker.io/rohankanojia/web-terminal-exec:fix-kube-admin-empty-uid"}]'

5. Delete DevWorkspace for old terminal and then open again
6. Terminal should load now as expected

[dkwon17]

WDYT if we remove the empty UID string check in getCurrentUserUIDFromOpenShiftUserAPI, but keep it in getCurrentUserUIDFromSelfSubjectReview, but reorder the checks so that we call getCurrentUserUIDFromOpenShiftUserAPI first, and treat getCurrentUserUIDFromSelfSubjectReview as the fallback?

This way, this should fix the regression with kube:admin without completely ignoring the empty UID case?