Move SSO configuration to standard tasks

[miki3421]

Summary

• add config/sso as a standard hierarchical ops task on branch 0.9.1
• move SSO/OIDC Kubernetes orchestration into a dependency-free Bun/TypeScript runner
• preserve unrelated admin-api env, envFrom, volumes, volume mounts, and annotations
• make disable idempotent and use targeted JSON Patch operations
• keep secrets out of task command lines and local config.json
• document the exact resources and values managed by the task

Architecture

All other public ops config commands are task-backed. SSO was the exception: main.go intercepted ops config sso and executed release-specific orchestration embedded in the CLI. That required publishing a new CLI for every SSO workflow change and allowed task help to become inconsistent with the installed CLI.

This pull request restores the standard architecture:

ops config sso
  -> config/sso/opsfile.yml
  -> config/sso/sso.ts

The YAML is declarative. Docopt values are passed through task environment variables, including the client secret, so they are not interpolated into a shell command line. The TypeScript runner invokes ops -config only as a stable local-config primitive.

Companion CLI PR: apache/openserverless-cli#43

Safe Kubernetes behavior

The task reads the target StatefulSet and generates JSON Patch operations only for exact, prefix-free references to its managed ConfigMap and Secret. Removal operations include JSON Patch test guards, preventing a concurrent list change from removing the wrong entry.

Repeated disable does not patch or roll out the StatefulSet. ConfigMap and Secret deletion uses --ignore-not-found. Removing an envFrom entry changes the pod template and starts the Kubernetes rollout naturally; the task waits for it unless --no-rollout is set and does not add a redundant restart annotation.

Validation

• Bun 1.3.14: bun test config/sso/sso.test.ts
• Bun 1.3.14: bun build config/sso/sso.ts --target=bun
• parsed config/opsfile.yml and config/sso/opsfile.yml with yq 4.47.1
• verified ops config sso and ops config sso --help through the normal CLI task dispatcher
• ran ops config sso keycloak --enable ... --no-rollout end-to-end with an isolated home and fake kubectl
• installed both PR branches in a Linux arm64 Lima VM and ran the original testing/tests/11-sso-mock.sh kind against the real Kind cluster (rc=0)
• live test covered the initial transient ingress 503, successful retry, password login, user provisioning, hello action deployment, and cleanup
• a foreign ConfigMap envFrom probe plus existing env, mounts, volumes, and annotations survived live enable -> disable -> enable

Tests cover foreign direct environment variables, ConfigMap and Secret envFrom entries, volumes, volume mounts, annotations, idempotent repeated disable, and the full enable -> disable -> enable cycle.