Reimplement keycloak/cilogon as PSA providers and remove custos

[nuwang]

This PR:

1. Removes code that relies on defunct custos services (custos auth provider and the custos vault)
2. Enhances the generic PSA oidc provider to support PKCE
3. Reimplements keycloak as an extension of this generic PSA provider
4. Reimplements cilogon as an extension of this generic PSA provider
5. Adds additional tests

supercedes: #21090
closes: #20789

Remaining:
Migrate CustosAuthnzToken model so that users do no need to reassociate accounts.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[ahmedhamidawan]

Suggested change

	- mapping.galaxy.mapping.prefer_oidc_login
	- mapping.galaxy.mapping.prefer_custos_login

Minor but this shouldn't change, because this line is from release 22.05's release notes, and should remain as originally written.