Extract OIDC JWT provider name as a constant in auth.go

Follow-up from #47.

operator/internal/controller/reconcilers/auth.go uses the string "oidc" as the JWT provider name in two places:

• buildInternalSecurityPolicy: provider["name"] = "oidc" (line ~155).
• buildGroupAuthorization: principal.jwt.provider = "oidc" (line ~234).

Envoy Gateway matches the authorization rule to the provider by this name. If a future change renames the provider in one spot without updating the other, the gateway will silently default-deny every request on the internal endpoint. Nothing in our unit tests or in EG's admission validation catches the mismatch.

Suggested fix

const internalJWTProviderName = "oidc"

at the top of auth.go, reference it from both call sites. Optionally add a table case asserting jwt.providers[0].name == principal.jwt.provider so the invariant is guarded by the test suite.

Start in operator/internal/controller/reconcilers/auth.go, reading buildInternalSecurityPolicy and buildGroupAuthorization. Replace both provider-name literals with the shared constant, then run the relevant auth reconciler unit tests and verify that the JWT provider name matches the group authorization principal; add the invariant case if the test structure supports it.