feat(keycloak): make Keycloak realm name configurable via platform values (currently hardcoded to "cozy") #4216

Problem

The Keycloak realm name cozy is hardcoded across several platform components. Operators cannot use a custom realm name (e.g. per-customer naming/branding conventions) without patching vendored charts — and such edits are reverted on make update / upgrade.

Where cozy is hardcoded

• packages/system/keycloak-configure/templates/configure-kk.yaml — realmName: cozy (this is the source of truth: it creates the realm, its clients and the cozystack-cluster-admin roles)
• packages/system/dashboard/templates/gatekeeper.yaml — --oidc-issuer-url=https://keycloak.{{ host }}/realms/cozy (plus login/logout URLs), and dashboard/templates/keycloakclient.yaml realmRef
• packages/system/linstor-gui/templates/gatekeeper.yaml + its keycloakclient.yaml — same pattern
• packages/extra/info/templates/kubeconfig.yaml — generates the user kubeconfig pointing at /realms/cozy

The kube-apiserver OIDC issuer is already flexible (set via talm oidcIssuerUrl). This actually makes the mismatch worse: an operator can point the apiserver at a custom realm, but every UI/SSO component stays on cozy, so SSO breaks with an issuer mismatch.

Impact

• No supported way to rename the realm. A partial change silently breaks SSO — the apiserver, dashboard, linstor-gui and generated kubeconfig must all agree on the same issuer.
• Adapting the login experience/naming for a specific deployment currently requires either forking the templates or a displayName-only workaround (technical realm name stays cozy).

Proposal

Add a single configurable realm name to the platform Package values, e.g. authentication.oidc.realmName (default cozy), and thread it through all the templates above:

• keycloak-configure: realm + clients + roles
• dashboard & linstor-gui: gatekeeper issuer/login/logout URLs + KeycloakClient.realmRef
• info: generated kubeconfig issuer

This keeps cozy as the default (no behaviour change for existing clusters) while letting operators set a custom realm name in one place, consistently across apiserver OIDC and all SSO components.