Select the identity provider by configuration

[oysand]

Adds Authentication:Provider, defaulting to EntraId. Setting it to Oidc points both inbound token validation and outbound downstream-API token acquisition at any conformant OpenID Connect issuer — a Keycloak realm for local development and for the armada integration tests, or an operator's own issuer for a deployment outside Azure.

This is not an authentication bypass: issuer, audience, signature, lifetime and role validation stay enabled under either value, only the issuer differs. What is gated is transport security — a plain HTTP authority is accepted only in Local and IntegrationTest, and throws at startup anywhere else.

Two implementation notes worth a reviewer's attention:

• The inbound override is split across Configure and PostConfigure. JwtBearerPostConfigureOptions rejects an HTTP authority and runs before any post-configuration we can register, while Microsoft.Identity.Web installs its AadIssuerValidator during post-configuration.
• Outbound, IDownstreamApi resolves every bearer token through IAuthorizationHeaderProvider, so replacing that one service covers ISAR, SARA and Pointilla. The token endpoint is read from the discovery document rather than assumed.

Commit 1 is unrelated and separable: MockSignalRService has a pre-existing race that fails on clean main (3 of 3 isolated runs). It is included because it stood between this branch and a green CI run; say the word and I will split it out.

Verified: 106/106 tests, dotnet build -warnaserror and csharpier clean, each commit builds individually. The Flotilla → ISAR hop is proven in the full integration suite (equinor/armada#87, 4/4 green).

Merge order: equinor/isar#1158 → isar-robot bump → this PR + equinor/sara#456 → images published → equinor/armada#87.

Supersedes #2856, which stays open as a fallback until this set is approved.

[oysand]

The Flotilla → ISAR hop is now verified end to end (equinor/armada#87, full suite green). From the run:

Resolved token endpoint http://keycloak:8080/realms/robotics/protocol/openid-connect/token
  from http://keycloak:8080/realms/robotics/.well-known/openid-configuration
Acquiring token for scope 'isar-api' from http://keycloak:8080/realms/robotics/protocol/openid-connect/token

followed by 9 Api.Services.IsarService calls. Both Keycloak-specific fixes to GenericOidcAuthorizationHeaderProvider — discovery-based token endpoint, and sending client_secret — work against a real downstream service. That was the only gap listed under Verification; this PR is now fully verified.