authentik: add Grafana OAuth2/OIDC provider + application

Adds an OIDC provider + application so the in-cluster Grafana
(grafana.k8s.syd1.au.unkin.net) can authenticate users against Authentik.

Extends the oauth2 module so provider config stays declarative and
secret-free:
- Resolve authorization/invalidation flows by slug (data.authentik_flow)
  and scope mappings by managed identifier
  (data.authentik_property_mapping_provider_scope).
- Read client_secret from Vault kv-v2 (data.vault_kv_secret_v2) instead of
  committing it; adds the hashicorp/vault provider (auth via VAULT_ADDR/
  VAULT_TOKEN from the Makefile).
- Support allowed_redirect_uris on the oauth2 provider.

config/providers_oauth2/grafana.yaml wires client_id `grafana`, the
openid/email/profile scopes, the login/generic_oauth redirect URI, and
points client_secret at kv/kubernetes/namespace/grafana/default/oauth-credentials.

modules/authentik/variables.tf

@@ -24,13 +24,24 @@ variable "providers_saml" {
 
 variable "providers_oauth2" {
   type = map(object({
-    name                  = string
-    authorization_flow    = string
-    invalidation_flow     = string
-    client_type           = optional(string, "confidential")
-    client_id             = string
-    client_secret         = optional(string, null)
-    property_mappings     = optional(list(string), [])
+    name               = string
+    authorization_flow = string # flow slug, resolved to id via data.authentik_flow
+    invalidation_flow  = string # flow slug, resolved to id via data.authentik_flow
+    client_type        = optional(string, "confidential")
+    client_id          = string
+    # client_secret is never committed. Point at a Vault kv-v2 secret whose
+    # `client_secret` key holds the value (seeded out of band); TF reads it.
+    client_secret_vault = optional(object({
+      mount = string
+      path  = string
+    }), null)
+    # Managed identifiers of scope property mappings (e.g.
+    # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
+    scope_mappings = optional(list(string), [])
+    redirect_uris = optional(list(object({
+      matching_mode = optional(string, "strict")
+      url           = string
+    })), [])
     signing_key           = optional(string, null)
     access_token_validity = optional(string, "minutes=10")
   }))