Support the dynamic KeycloakPolicyEnforcerAuthorizer tenants

[sberyozkin]

Description

KeycloakPolicyEnforcerAuthorizer tenants configured in application.properties are supported in 2.0.0.x but it is not possible to create them programmatically yet as can be done for OIDC tenants with TenantConfigResolver.

Implementation ideas

Add TenantPolicyConfigResolver which would accept RoutingContext and the current OIDC tenantId and return KeycloakPolicyEnforcerTenantConfig and have it injected in PolicyEnforcerResolver.

PolicyEnforcerResolver would check TenantPolicyConfigResolver first - if it returns KeycloakPolicyEnforcerTenantConfig then Function will be used to convert it to PolicyEnforcer - this function will be passed from KeycloakRecorder to PolicyEnforcerResolver in its constructor similarly to how it is done in OidcRecorder.

It should be enforced for web-app tenants only (as is already done for the configured web-app tenants) that the current OidcTenantConfig also has quarkus.oidc.roles.source=accesstoken. The current dynamic OidcTenantConfig is available as RoutingContext dynamic.tenant.config attribute.

A simple test would have to be added to integration-tests/keycloak-authorization - it already has one test for the configured non-default tenant - so another similar test should be added for the dynamically created one

CC @pedroigor

[ethan-gallant]

Hello!

I currently have a working implementation of this in #17750. Please let me know if anything should be changed or modified. The code is heavily inspired by the OIDC library which implements a very similar system.

Thank you for the guidance on how to implement this! :)