Support Keycloak `Signed JWT - Federated` flow for machine authentication to Airflow

### Description

Today the Keycloak Auth manager supports username/password and client credential authentication to the Airflow API.

I would like to support federated client authentication from external identity providers as detailed here: https://www.keycloak.org/2026/01/federated-client-authentication.

I would also propose a new configuration option that allows a list of valid clients, so not all the keycloak clients in a realm can generate Airflow tokens.

### Use case/motivation

I would like to generate temporary Airflow credentials using Keycloaks built in Kubernetes identity provider and a Kubernetes service account.

https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker_kubernetes

The goal is to allow API authentication from machines without a user account with static credentials or sharing the airflow client credentials.

We have several external services that interact with the Airflow API from Kubernetes, EC2 instances and other sources that either use static credentials or an in-house application (along with a custom auth provider) to generate a valid JWT.

The keycloak provider looks much more robust and could provide a better machine auth experience.

### Related issues

_No response_

### Are you willing to submit a PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Start by reading Airflow's existing Keycloak Auth manager paths for username/password and client-credential authentication, then review Keycloak's Signed JWT - Federated and Kubernetes identity-provider documentation. Define how federated tokens and the proposed valid-client list should be accepted by the Airflow API, with tests covering both successful authentication and rejected clients.

Written by the indexing model from the issue text.