[Ticket]: Authorino multi-issuer GitLab OIDC trust + claim mapping (values-driven)

**Type:** Feature

## Summary

We need **Authorino's external plane to trust a values-driven list of GitLab OIDC issuers** (gitlab.com + each self-hosted instance) and resolve their CI tokens to a Source, because GitLab CI parity requires validating GitLab `id_tokens` the way we validate GitHub Actions OIDC (ADR-0047). Epic ADORSYS-GIS/ai-helm#588.

Expected result:
> A GitLab CI token from any trusted instance is validated (correct issuer/JWKS), resolved via `/v1/resolve`, and stamped with the Source's `x-account-id`/`x-billing-plan`.

## Intent

Add GitLab as a first-class forge in the gateway authz, with instances added by config, not code.

## Source of truth (links)

- Epic ADORSYS-GIS/ai-helm#588; ADR-0078; sibling ADR-0047 (GitHub OIDC).

## Current Behavior

External AuthConfig (`kuadrant-policies-external`) trusts Keycloak + GitHub Actions OIDC only. GitLab issuers are unknown. Template: `charts/kuadrant-policies/templates/authconfig.yaml`.

## Expected Behavior

- The AuthConfig template renders **one JWT authentication method per trusted GitLab issuer** from a values list (each entry: issuer URL + JWKS/OIDC discovery). Adding an instance = adding a list entry (no template change).
- On a GitLab token: derive the provider-qualified key from `iss` + `namespace_id`, call `/v1/resolve`, stamp `x-account-id`/`x-billing-plan` from the Source (identical to GitHub).
- Synthetic identity `@gitlab-runners` and `missing:gitlab:` sentinels (ADR-0068/0052).
- Self-hosted reachability: document required egress + CA trust from the cluster to each instance's JWKS.

## Acceptance Criteria

- [ ] Given a values list with gitlab.com + ≥1 self-hosted issuer, when the chart renders, then Authorino has a JWT method per issuer with correct JWKS.
- [ ] Given a valid GitLab CI token with a bound Source, then `x-account-id` = the Source account.
- [ ] Given an unbound namespace, then deny + `missing:gitlab:*`.
- [ ] GitHub + Keycloak paths unchanged (regression).

## Out of Scope

`lightbridge-repo-auth` schema/resolve changes (separate ticket). The actual issuer list values + resolve branch wiring in `ai-helm-values` (separate values-repo-first ticket). GitLab CI docs.

## Technical Context

`charts/kuadrant-policies/templates/authconfig.yaml`; CEL descriptors/sentinels per ADR-0011/0052. Multi-issuer JWT config in Authorino. Values live in `ai-helm-values` (ADR-0056).

## Risks

Untrusted/unreachable self-hosted JWKS; issuer list is a security-sensitive trust surface. Mitigate: per-instance validation checklist, review of the list.

## Test Plan

`helm template` with a multi-issuer list; live verification against gitlab.com (and a self-hosted instance if available).

## Verification evidence

_To be filled: rendered AuthConfig with per-issuer methods; live GitLab CI token → correct stamping._

## Human accountable owner

@stephane-segning

## AI Usage Declaration

Drafting the ticket, Research, Proposing implementation. Verified by owner.

## Human verification completed

- [ ] I understood the intent
- [ ] I checked the source of truth
- [ ] I verified the implementation manually
- [ ] I documented remaining risks
- [x] I am the accountable owner and accept responsibility for this ticket.

Start with charts/kuadrant-policies/templates/authconfig.yaml and ADR-0078, then compare the existing GitHub Actions OIDC path described in ADR-0047. Run helm template with gitlab.com and one self-hosted issuer in the values list; done means each issuer has the correct JWT method and the listed resolve, sentinel, and GitHub/Keycloak regression behavior is verified.

Vom Indexierungsmodell aus dem Issue-Text verfasst.