[Ticket]: ai-helm-values GitLab issuer list + AuthConfig resolve branch (values-repo-first)

**Type:** Operational task

## Summary

We need to **add the GitLab issuer/JWKS list and the Authorino resolve branch to `ai-helm-values`** (values-repo-first), because the multi-issuer AuthConfig (ADR-0078) reads its trusted-issuer list and CEL from the values repo, not the chart (ADR-0056). Epic ADORSYS-GIS/ai-helm#588.

Expected result:
> `environments/prod/values/security-policies.yaml` carries the trusted GitLab issuers (gitlab.com + self-hosted) and the resolve/stamp branch, rendering a working multi-forge AuthConfig.

## Intent

Land the deployed configuration for GitLab trust, sequenced so it never breaks the live gateway AuthConfig.

## Source of truth (links)

- Epic ADORSYS-GIS/ai-helm#588; ADR-0078; ADR-0056 (values-repo-first), ADR-0055.

## Current Behavior

`security-policies.yaml` (the ~405-line AuthConfig) trusts Keycloak + GitHub only. GitLab issuers absent.

## Expected Behavior

- Add the GitLab issuer entries (issuer URL + JWKS) and the resolve/stamp branch, matching the chart template from the Authorino ticket.
- Per-instance egress/CA trust prerequisites captured (self-hosted JWKS reachability).

## Acceptance Criteria

- [ ] `render-check` (YAML + `helm template` of the OCI charts) is green with the GitLab issuers present.
- [ ] Change merges **only after** the chart template support (Authorino ticket) and `lightbridge-repo-auth` GitLab resolve exist — else the gateway AuthConfig breaks (ADR-0056). Explicit dependency.
- [ ] Live: a GitLab CI token → correct `x-account-id`; GitHub/Keycloak unchanged.

## Out of Scope

Chart template logic (Authorino ticket). `lightbridge-repo-auth` (separate ticket). Docs.

## Technical Context

`ai-helm-values` `environments/prod/values/security-policies.yaml`; `render-check.yml`. **Sequencing gate: lands last.**

## Risks

Mis-sequenced merge drops the gateway AuthConfig (high impact). Mitigate: values-repo-first, explicit dependency, render-check.

## Test Plan

`render-check`; live header verification for GitLab / GitHub / Keycloak.

## Verification evidence

_To be filled: render-check output; live header checks._

## Human accountable owner

@stephane-segning

## AI Usage Declaration

Drafting the ticket, Proposing implementation. Verified by owner.

## Human verification completed

- [ ] I understood the intent
- [ ] I checked the source of truth
- [ ] I verified the implementation manually
- [ ] I documented remaining risks
- [x] I am the accountable owner and accept responsibility for this ticket.

Start with environments/prod/values/security-policies.yaml and ADR-0056/ADR-0078, comparing the existing Keycloak and GitHub entries with the linked Authorino chart-template work. Confirm the lightbridge-repo-auth dependency, then run render-check.yml. Done means the values render successfully with GitLab issuers and live GitLab, GitHub, and Keycloak tokens produce the expected account headers.

Vom Indexierungsmodell aus dem Issue-Text verfasst.