AgentConnect: acr="eidas0" from ProConnect fails with an unhelpful "cannot be retrieved" error

### Description

`EidasLevel` (`src/main/java/fr/insee/keycloak/providers/common/EidasLevel.java`) only defines `EIDAS1`, `EIDAS2`, `EIDAS3`. There is no `EIDAS0`, and no `eidas0` option anywhere in the admin configuration (the eIDAS-level dropdown only offers eidas1/2/3).

However, ProConnect can legitimately return `"acr": "eidas0"` on the ID token — it's the base, non-eIDAS-certified assurance level used by identity providers that aren't eIDAS-notified (e.g. plain email/password FIs). When that happens, `AbstractBaseIdentityProvider#validateAcrClaim` calls `EidasLevel.getOrDefault("eidas0", null)`, which returns `null` since there's no matching enum constant, and the login fails with:

```
org.keycloak.broker.provider.IdentityBrokerException: The returned eIDAS level cannot be retrieved
```

This is the same message used for a genuinely unparseable/unexpected ACR value, so from the logs alone there's no way to distinguish "ProConnect sent us something we don't understand" from "this specific, well-known ACR value (`eidas0`) isn't supported yet."

We ran into this repeatedly while validating an unrelated 2FA-related change against a real ProConnect environment — it's unrelated to that change and reproduces the same way regardless of the `mfa_mode`/2FA configuration.

### Question for maintainers

What's the intended behavior here? A couple of options, happy to send a PR once there's a preferred direction:

1. Add `EIDAS0` as a selectable floor, so realms that are fine with non-eIDAS-certified logins can explicitly allow it.
2. Keep rejecting it by default (since it's below the lowest currently-supported floor, `eidas1`), but with a clearer message than "cannot be retrieved" so it's distinguishable from a truly unexpected ACR value.

Read src/main/java/fr/insee/keycloak/providers/common/EidasLevel.java and AbstractBaseIdentityProvider#validateAcrClaim to trace how eidas0 is parsed and rejected. Check the admin configuration path for the eIDAS-level dropdown, then confirm with maintainers whether the expected outcome is selectable eidas0 support or a clearer rejection; done requires the agreed behavior and corresponding tests.

Written by the indexing model from the issue text.