Dex SSO auth via internal Dex address

# Summary

What change needs making?
Possibility to handle authentication related communication between Argo Server and ArgoCD's Dex via internal address.

When setting up SSO authentication via ArgoCD's Dex the issuer URL is expected to be accessible via it's external address (a reverse proxy built into argocd-server), while sometimes this is restricted by company network policies.

Introducing the `issuerAlias` in v3.2.0 (https://github.com/argoproj/argo-workflows/pull/6831) partially solved the problem helping to bypass the issuer verification, but not completely.

The discovery config returned from the `.well-known/openid-configuration` endpoint still contain external addresses which breaks the auth flow, after the SSO auth redirects back to the Argo Server's address.
The following message is seen in the browser:
```failed to exchange token: Post "https://{{ArgoCD-external-address}}/api/dex/token": read tcp X.X.X.X:36976->Y.Y.Y.Y:443: read: connection reset by peer```

X.X.X.X is the argo-server pod's IP
Y.Y.Y.Y is the ArgoCD's external IP (pointed by the issuer URL)

ArgoCD itself solves the issue for it's internal authentication via injecting a RoundTripper object to the OIDC client, which rewrites the address and the scheme of the URL before HTTP messages reach the transport layer:
https://github.com/argoproj/argo-cd/blob/master/util/oidc/oidc.go#L126-L128

# Use Cases

When would you use this?
- when external connections are restricted from the cluster
- when someone wants optimized/simpler network routes to be used

---

**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Start at the OIDC client flow that consumes the .well-known/openid-configuration response and exchanges the token with Dex. Compare the ArgoCD oidc.go RoundTripper approach linked in the issue, then trace how issuerAlias is currently applied. Done means discovery and token-exchange requests use the internal Dex address so the SSO redirect completes without reaching the restricted external address.

Written by the indexing model from the issue text.