[Plugin] OCI — Identity & Access Management (IAM)

## Summary

The OCI Identity & Access Management sub-plugin for `plugin-oci` enables Kestra flows to automate user, group, dynamic group, and policy lifecycle operations on OCI IAM. This empowers platform and security teams to provision and deprovision access as part of onboarding flows, enforce least-privilege policies programmatically, and audit IAM state across compartments — all from within a Kestra pipeline.

## Motivation

Security and platform teams managing OCI tenancies face repetitive IAM tasks: creating service users for new applications, adding users to groups, creating policies for new compartments, and cleaning up access when projects wind down. Today these tasks are performed manually in the OCI console or via OCI CLI scripts outside any orchestration context. A native IAM sub-plugin lets teams express these operations as typed, auditable flow tasks that integrate with approval gates, notifications, and downstream provisioning steps.

## Context

Part of the OCI Plugin Suite EPIC: https://github.com/kestra-io/plugin-oci/issues/2
Reference: `plugin-aws` IAM tasks.

## API Reference

- **Official docs**: https://docs.oracle.com/en-us/iaas/api/#/en/identity/latest/
- **Authentication**: Config-file (`~/.oci/config`) — IAM operations require a user with `IAM_INSTANCE` or full IAM admin privileges; instance principal is typically insufficient for IAM mutations
- **Base URL pattern**: `https://identity.{region}.oraclecloud.com/20160918/`
- **SDK**: OCI Java SDK v3.87.0 via BOM

## Gradle Dependencies

Add to `build.gradle`:

```groovy
// OCI Java SDK BOM
implementation platform("com.oracle.oci.sdk:oci-java-sdk-bom:3.87.0")
// Identity (IAM)
implementation "com.oracle.oci.sdk:oci-java-sdk-identity"
implementation "com.oracle.oci.sdk:oci-java-sdk-common"
```

## Plugin Structure

- **Repository**: `plugin-oci`
- **Namespace**: `io.kestra.plugin.oci.iam`
- **Sub-plugins**: `iam` (users, groups, policies, dynamic groups)

## Suggested Tasks

1. `CreateUser` — create a new IAM user with description and email
2. `DeleteUser` — delete a user by OCID
3. `GetUser` — fetch user details and emit OCID, state as outputs
4. `ListUsers` — list users in the tenancy with optional name filter
5. `CreateGroup` — create a new IAM group
6. `DeleteGroup` — delete a group
7. `AddUserToGroup` — add a user to a group
8. `RemoveUserFromGroup` — remove a user from a group
9. `CreatePolicy` — create a policy with one or more policy statements
10. `DeletePolicy` — delete a policy
11. `ListPolicies` — list policies in a compartment
12. `CreateDynamicGroup` — create a dynamic group with a matching rule
13. `DeleteDynamicGroup` — delete a dynamic group
14. Write unit + integration tests

## YAML Examples

### Example 1 — Create a service user and add it to a group

```yaml
id: provision_service_account
namespace: company.platform

inputs:
- id: service_name
type: STRING

tasks:
- id: create_user
type: io.kestra.plugin.oci.iam.CreateUser
region: eu-frankfurt-1
tenancyOcid: "{{ secret('OCI_TENANCY_OCID') }}"
userId: "{{ secret('OCI_USER_OCID') }}"
fingerprint: "{{ secret('OCI_FINGERPRINT') }}"
privateKey: "{{ secret('OCI_PRIVATE_KEY') }}"
name: "svc-{{ inputs.service_name }}"
description: "Service account for {{ inputs.service_name }}"
email: "svc-{{ inputs.service_name }}@company.com"

- id: add_to_group
type: io.kestra.plugin.oci.iam.AddUserToGroup
region: eu-frankfurt-1
tenancyOcid: "{{ secret('OCI_TENANCY_OCID') }}"
userId: "{{ secret('OCI_USER_OCID') }}"
fingerprint: "{{ secret('OCI_FINGERPRINT') }}"
privateKey: "{{ secret('OCI_PRIVATE_KEY') }}"
userId: "{{ outputs.create_user.userId }}"
groupId: "{{ secret('OCI_SERVICE_ACCOUNTS_GROUP_OCID') }}"

- id: log
type: io.kestra.plugin.core.log.Log
message: "Created user {{ outputs.create_user.userId }} and added to service-accounts group"
```

### Example 2 — Create a policy for a new compartment

```yaml
id: create_compartment_policy
namespace: company.platform

inputs:
- id: compartment_name
type: STRING
- id: compartment_ocid
type: STRING

tasks:
- id: create_policy
type: io.kestra.plugin.oci.iam.CreatePolicy
region: eu-frankfurt-1
tenancyOcid: "{{ secret('OCI_TENANCY_OCID') }}"
userId: "{{ secret('OCI_USER_OCID') }}"
fingerprint: "{{ secret('OCI_FINGERPRINT') }}"
privateKey: "{{ secret('OCI_PRIVATE_KEY') }}"
compartmentId: "{{ secret('OCI_TENANCY_OCID') }}"
name: "policy-{{ inputs.compartment_name }}"
description: "Access policy for compartment {{ inputs.compartment_name }}"
statements:
- "Allow group Developers to manage all-resources in compartment {{ inputs.compartment_name }}"
- "Allow group Auditors to read all-resources in compartment {{ inputs.compartment_name }}"

- id: log
type: io.kestra.plugin.core.log.Log
message: "Policy {{ outputs.create_policy.policyId }} created for compartment {{ inputs.compartment_name }}"
```

### Example 3 — List all IAM users and log active count

```yaml
id: audit_iam_users
namespace: company.platform

tasks:
- id: list_users
type: io.kestra.plugin.oci.iam.ListUsers
region: eu-frankfurt-1
tenancyOcid: "{{ secret('OCI_TENANCY_OCID') }}"
userId: "{{ secret('OCI_USER_OCID') }}"
fingerprint: "{{ secret('OCI_FINGERPRINT') }}"
privateKey: "{{ secret('OCI_PRIVATE_KEY') }}"
compartmentId: "{{ secret('OCI_TENANCY_OCID') }}"
lifecycleState: ACTIVE

- id: log_count
type: io.kestra.plugin.core.log.Log
message: "Tenancy has {{ outputs.list_users.count }} active IAM users"
```

## Acceptance Criteria

- [ ] `CreateUser`, `DeleteUser`, `GetUser`, `ListUsers` tasks implemented
- [ ] `CreateGroup`, `DeleteGroup`, `AddUserToGroup`, `RemoveUserFromGroup` tasks implemented
- [ ] `CreatePolicy`, `DeletePolicy`, `ListPolicies` tasks implemented
- [ ] `CreateDynamicGroup`, `DeleteDynamicGroup` tasks implemented
- [ ] All `Property` fields support Kestra expression language
- [ ] Unit + integration tests pass (`./gradlew test`)
- [ ] `package-info.java` with `@PluginSubGroup(category = PluginSubGroup.PluginCategory.CLOUD)`
- [ ] Build passes with `./gradlew build`

Start by reviewing the existing plugin-aws IAM tasks and plugin-oci's build.gradle to understand task structure and SDK dependencies. Add the IAM sub-plugin under io.kestra.plugin.oci.iam, including the listed user, group, policy, and dynamic-group tasks, package-info.java, and unit and integration tests. Done means ./gradlew test and ./gradlew build pass and all acceptance criteria are met.

Written by the indexing model from the issue text.