Wire Rancher to Authentik ak_groups + akP-rancher global roles

Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical
`ak_groups` claim and grant Rancher global roles to the akP-rancher permission
groups. Members of akR-global-admin/akR-standard-user inherit these.

- keycloakoidc: scopes += ak_groups; groups_field = ak_groups
- global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user
  (group principal keycloakoidc_group://<name>)

config/config.hcl

@@ -8,5 +8,10 @@ locals {
 
   config = {
     keycloakoidc = try(local.all_configs["keycloakoidc.yaml"], null)
+    global_role_bindings = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "global_role_bindings/")
+    }
   }
 }

config/global_role_bindings/akP-rancher-admin.yaml

@@ -0,0 +1,3 @@
+# akP-rancher-admin -> Rancher global admin. Granted to akR-global-admin members
+# (inherited) and direct members.
+global_role_id: admin

config/global_role_bindings/akP-rancher-user.yaml

@@ -0,0 +1,3 @@
+# akP-rancher-user -> standard Rancher user global role. Granted to
+# akR-standard-user members (inherited) and direct members.
+global_role_id: user

config/keycloakoidc.yaml

@@ -6,7 +6,10 @@ rancher_url: https://rancher.k8s.syd1.au.unkin.net/verify-auth
 client_id: rancher
 issuer: https://identity.unkin.net/application/o/rancher/
 auth_endpoint: https://identity.unkin.net/application/o/authorize/
-scopes: openid profile email
+# ak_groups = hierarchical group claim from terraform-authentik (permission
+# groups inherited via role groups). groups_field points Rancher at that claim.
+scopes: openid profile email ak_groups
+groups_field: ak_groups
 access_mode: unrestricted
 enabled: true
 client_secret_vault: