Default OAuth2 providers to RS256 ID token signing

OAuth2 providers with no signing_key fall back to HS256, which RS256-only
RP clients (argocd confirmed, and the rest) reject with "unexpected
signature algorithm HS256; expected [RS256]", breaking OIDC login.

- Add data.authentik_certificate_key_pair.signing, resolving the estate's
  RSA keypair by name (var.oauth2_signing_key_name, default the built-in
  "authentik Self-signed Certificate").
- Default every provider's signing_key to that keypair via coalesce, so all
  providers sign with RS256 while keeping the per-yaml signing_key override.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

modules/authentik/variables.tf

@@ -98,6 +98,14 @@ variable "providers_oauth2" {
   default = {}
 }
 
+# Name of the RSA certificate keypair used to sign OAuth2 ID tokens (RS256) for
+# every provider that does not set its own signing_key. Defaults to Authentik's
+# built-in self-signed RSA keypair.
+variable "oauth2_signing_key_name" {
+  type    = string
+  default = "authentik Self-signed Certificate"
+}
+
 variable "providers_ldap" {
   type = map(object({
     name             = string