[Feature] Keycloak migration via OpenTofu (Terraform)

### Relevant component

_No response_

### Problem description (optional)

We currently use `klg71/keycloakmigration` in the dev stack to setup keycloak, which is not broadly used and there are some official alternatives.
Also it would be great to use the locally modified client config for the production clients ("bring you own client").
Some of the pain points to fix:
- Different client behavior local and production
The production configuration as code would also fix:
- Unknown custom config

### Desired solution

Use or test out an keycloak OpenTofu/Terraform CaC tool, which is also usable for production.
Side cases to test:
- Rerun migration if keycloak was reset
- What happens to manual changes (overwriten?)

### Considered alternatives (optional)

_No response_

### Additional context (optional)

- https://opentofu.org/docs/intro/install/docker/
- https://search.opentofu.org/provider/keycloak/keycloak/latest
- https://github.com/keycloak/keycloak/discussions/30643

### No duplicate

- [x] I confirm that this issue is not a duplicate

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct