Translate identityFromToken from CRD to runtime config

[jhrozek]

Translate identityFromToken from CRD to runtime config

Description

Phase 4 of the Snowflake / identityFromToken story (#5150). Wire the
new CRD field through the operator-side run-config so the embedded
auth server actually receives it. Mirrors the existing
tokenResponseMapping plumbing exactly. Without this, the CRD field
exists and the provider integration honours it, but no real cluster
deployment can connect the two ends.

Context

The CRD field added in #5155 lives on the v1beta1
OAuth2UpstreamConfig. The runtime field consumed by the OAuth2
upstream provider in #5156 lives on pkg/authserver/upstream's
OAuth2Config. Two translation points carry it through:

• cmd/thv-operator/pkg/controllerutil/'s auth-server config builder
  takes the v1beta1 type and produces a pkg/authserver run-config.
• pkg/authserver/runner/'s embedded-auth-server bootstrapper takes
  that run-config and produces the runtime pkg/authserver/upstream
  config the provider consumes.

Both translations are mechanical mirrors of the existing
tokenResponseMapping translation — no validation logic in the
runner; that is owned by the CRD admission validator and the
OAuth2Config.Validate() method.

Dependencies: #5155 (CRD type), #5156 (runtime config mirror).
Blocks: nothing in the implementation chain — but a real cluster
deployment cannot honour identityFromToken until both translation
points are in place.

Acceptance Criteria

• The v1beta1 → run-config translation copies the
  identityFromToken block (with all three paths) into the
  authserver run-config.
• The run-config → runtime translation does the same for the
  pkg/authserver/upstream provider config.
• Nil-config does not allocate a runtime block (no spurious
  pointers).
• Round-trip tests on both translation points cover the all-three-
  paths case and the nil case.
• task lint-fix and task test pass.

Out of Scope

• Validation logic — already enforced by the CRD admission validator
  (Add identityFromToken to MCPExternalAuthConfig CRD #5155) and the runtime Validate() (Wire identityFromToken into the OAuth2 upstream provider #5156).
• Synthesis-mode-detection helpers — separate task.
• YAML examples — separate task.