SPIFFE support #26787

Add support for SPIFFE JWT-SVIDs for machine-to-machine authentication.

• Add a SPIFFE source that can be configured with:
  • trust domain
  • OIDC/JWKS URL
  • expected audience
  • optional allowed SPIFFE ID patterns
• Allow services to use a JWT-SVID when requesting an OAuth token from authentik.
• Validate the token's signature, expiry, audience, trust domain, and SPIFFE ID.
• Use the SPIFFE ID as the service identity and map it to an authentik service account.
• Make the SPIFFE ID and token claims available to policies and property mappings.
• Issue a normal authentik OAuth token after the service has been authenticated.