Introduces OIDC authentication support with provider configuration, auto-provisioning options, and admin group mapping. Adds 'base-url' and 'ui-url' properties for API and UI endpoints, and updates the database password.

…for OIDC providers

This commit addresses vulnerabilities, updates configuration examples, and resolves code quality issues flagged by CI in the OIDC implementation.

- Security:
  - Sanitize `providerId` in `OidcAuthenticator` before logging to prevent log injection.
  - Validate `providerId` in `LoginController` to fix a trust boundary violation.

- Refactor:
  - Removed unused `providerId` and `request` parameters from the OIDC callback method.

- Feature:
  - Added an `iconUri` field to `OidcProviderConfig` to support custom provider icons on the login page.

- Configuration:
  - Updated `application.yaml` to include the new `icon-uri` property in the Keycloak provider example, demonstrating the feature.
  - Improved the commented-out `issuer-uri` example for better use in containerized environments (e.g., Docker).

- Improves unit test coverage for the OIDC module by adding tests for failure scenarios, provider validation, and new fields like `iconUri`.
- Adds a null check in `LoginController` to gracefully redirect if the OIDC authorization URL fails to generate.

Expanded OIDC login API test coverage with additional negative and edge case scenarios, improved assertions, and refactored test structure. Updated OidcLoginPage to decouple from LoginPage and added helper methods for negative testing. Docker Compose and Keycloak realm export were updated for improved health checks, initialization, and OIDC configuration to support more robust integration testing.

…n Docker test environment

Refactored the OIDC API test environment and the `OidcLoginAPITest` class to improve stability, precision, and alignment with project best practices.

Environment Changes:
- Updated `docker-compose.yaml` to use the `apache/dolphinscheduler-standalone-server:ci` image.
- Removed the external MySQL and Zookeeper services and the test now leverages the default H2 database and embedded Zookeeper from the standalone server, simplifying the setup and increasing execution speed.

Test Logic Improvements:
- Added `@Slf4j` for logging in `OidcLoginAPITest`.
- Made the assertion in `testLoginEndpointDisabledInOidcMode` more precise by checking for a specific "HTTP 401 Unauthorized" status code instead of a generic non-200 response.

… issues

This commit includes a series of refactors and fixes to the OIDC authentication module in the API, as well as a formatting fix for the UI.

Backend (`dolphinscheduler-api`):
- LoginController:
  - Switched from field injection to constructor injection for all dependencies to align with modern Spring best practices and improve testability.
  - Added a leading slash to OIDC endpoint mappings (`/oidc-providers`, `/login/oauth2/code/{providerId}`) for consistency across the application.
  - Resolved a SonarQube warning by binding the `{providerId}` path variable in the OIDC callback handler and using it to validate the `state` parameter, enhancing security.

- OidcAuthenticator:
  - Eliminated duplicated string literals by introducing constants for the "email" attribute and the log sanitization regex, resolving high-impact SonarQube issues.

Frontend (`dolphinscheduler-ui`):
- Code Formatting:
  - Executed `pnpm run lint` to correct code style and formatting issues, ensuring the frontend build passes all CI checks.

Added specific OIDC error statuses to the Status enum and improved error handling in OidcAuthenticator for token exchange and ID token validation. Refactored SecurityConfig and OidcAuthenticator to use constructor-based dependency injection for OIDC configuration and UsersService, ensuring required beans are present for OIDC authentication.

Expanded authentication documentation to include OIDC (OpenID Connect) support, detailing configuration steps for various providers and local development with Keycloak. Added a new guide for setting up a local OIDC environment and updated API test README with instructions for running OIDC-related API tests using Docker and Testcontainers.

Refactored OIDC authentication to use ApiConfig for base and UI URLs, improving configuration consistency. Enhanced logging by sanitizing sensitive state and provider IDs. Updated documentation for OIDC setup, removed unused constructor in HttpResponse, and added OidcLoginAPITest to the API test workflow.

Adds a null check for missing OIDC providers in OidcAuthenticator to prevent errors. Updates related tests to mock ApiConfig instead of using a @value property, and adjusts test setup accordingly. Also updates OidcLoginPage to use an empty HashMap for request parameters.

This commit resolves a proper role synchronization logic and adds a comprehensive API test suite to validate the entire OIDC feature.
The solution involved these changes:

1.  Implement Role Synchronization on Every Login:
    - The logic in `OidcAuthenticator` has been refactored to check and update a user's role on every login, not just on initial creation. This ensures the OIDC provider remains the single source of truth for user roles.
    - A new, simplified `updateUser(User user)` method was added to the `UsersService` layer to support this synchronization in a clean, decoupled manner.

2.  Fix Configuration Property Loading:
    - A subtle but critical bug was fixed where nested OIDC configuration properties (specifically security.authentication.oidc.user.admin-group-mapping) were not being loaded from application.yaml.
    - This was resolved by adding the `@NestedConfigurationProperty` annotation in `OidcConfigProperties`, which is the standard Spring Boot practice for ensuring nested configuration objects are correctly populated.

3.  Improved OIDC API Test Suite:
    - The test suite provides coverage for:
        - Correct redirect behavior for valid and invalid providers.
        - Graceful handling of OIDC callback errors and malformed requests.
        - Security policy enforcement (verifying password login is disabled in OIDC mode).
        - A full, successful login simulation for a general user to ensure no regressions.
4. Other improvements include:
    - Replaced the sanitizeForLogging method in OidcAuthenticator with the existing RegexUtils.escapeNRT method to promote code reuse and remove redundant code.
    - API test cleanup: Introduce enums to replace scattered hardcoded delimiters and HTML entity constants. Apply replacements only where they improved clarity and maintainability.

This commit resolves a critical issue where OIDC user roles were not correctly assigned or updated. It introduces robust role synchronization on every login, adds a test to check Admin User Successfull Login in API test, and improves the developer documentation.
Change Log:
1.  Fix Role Synchronization bug in OidcAuthenticator:
The logic in `OidcAuthenticator` has been refactored to check and update a user's role on every login, not just on initial creation. This ensures the OIDC provider remains the single source of truth for user roles and closes a security vulnerability where role de-provisioning was ignored.

2.  Enhance OIDC API Test to coverage a full, successful login simulation for admin users.

3.  Updated the development documentation to use the Maven Wrapper (`./mvnw`) instead of the local `mvn` command. This ensures all contributors use the same Maven version as the project, reducing version compatibility issues and developer setup overhead.