[SebastienLaurent-CF]

✨ Support public OIDC clients (no client secret)

Context

authk required a clientSecret, so it could not connect to a Keycloak client with
Client authentication: Off (public client).

Changes

• clientSecret is now optional in the CUE schema (defaults to empty)
• New authMethod: "none" value for public clients
• When the client is public (authMethod: "none" or no secret), client_id is sent
  in the request body with no client_secret and no Authorization: Basic header
• Token refresh works the same way for public clients
• A public client cannot use the Client Credentials flow: authk now returns a clear
  error when no user credentials are configured, without calling the token endpoint
• If authMethod: "none" is set while a secret is configured, the secret is ignored
  and a warning is logged

Configuration example

oidc: {
        issuerUrl:  "https://keycloak.example.com/realms/myrealm"
        clientId:   "my-public-client"
        authMethod: "none"
}
user: {
        username: "myuser"
        password: "mypassword"
}
Keycloak side: Client authentication off, Direct access grants enabled.

Tests

- Config: a config without a clientSecret loads
- OIDC client: the token request contains no secret and no Basic header,
  and client_credentials is refused for public clients
- go vet and go test ./... pass
- Not tested against a real Keycloak instance (only a mock server)

Notes

- Backward compatible: existing configurations with a secret are unchanged
- An empty secret (e.g. a ref+env:// that resolves to nothing) now switches to
  public client mode instead of failing
- Based on feat/id-token: merge that branch first, or retarget this MR