Add desired-state Keycloak configuration with keycloak-config-cli

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

The Keycloak integration can start a server and import realm JSON for local development, but it does not provide an idempotent way to manage the desired configuration state of Aspire-managed Keycloak instances. Realms, clients, users, roles, identity providers, and related settings currently require manual setup, custom scripts, or custom images. Realm import also does not provide a complete update/reconciliation model for an existing instance.

This is part of the roadmap tracked by #1326.

### Describe the solution you'd like

Investigate first-class integration with [adorsys/keycloak-config-cli](https://adorsys.github.io/keycloak-config-cli/) as the mechanism for applying desired Keycloak configuration.

A likely model is a companion resource or lifecycle operation associated with a `KeycloakResource` that:

- Waits for Keycloak to become healthy before applying configuration.
- Accepts one or more configuration files or directories.
- Applies configuration idempotently so rerunning the AppHost converges the instance to the declared state.
- Supports parameters and secrets without exposing admin credentials or generated client secrets.
- Produces useful logs and failures in the Aspire resource model.
- Has a defined behavior for both run mode and publish/deploy scenarios.
- Can evolve to support existing Keycloak instances where appropriate.

The API shape should align with established Aspire resource and lifecycle patterns rather than exposing the config CLI's container details directly.

### Additional context

Related work:

- #1326 tracks the overall Keycloak integration roadmap.
- #5092 tracks first-class realm resources and realm endpoint modeling.
- #18097 tracks the broader deploy-time problem of values produced by a running resource flowing into dependent resources.

Start with KeycloakResource and the established Aspire resource and lifecycle patterns, then review the keycloak-config-cli behavior described in the issue. Define how configuration files, parameters, secrets, health waiting, logs, failures, and run versus publish/deploy scenarios should work; done means the API and reconciliation behavior are specified well enough to implement.

Written by the indexing model from the issue text.