Idempotent bootstrap (with service account)

[popcornylu]

Introduction

when helm upgrade, the bootstrap script should update client setting idempotently.

Tasks

• [x] add the primehub client that play the admin-ui role in ce
• [x] bootstrap with service account
• [x] primehub should enable service account with realm-management client role
• [x] check the behavior of keycloak mapper update api for idempotent (e.g. adding timezone mapper)

Testing Scenario

1. Install
2. Upgrade
3. Upgrade again
4. add new protomapper (e.g. timezone) and upgrade again.

[popcornylu]

Current upgrade limitation. It only upgrade

1. protocol mapper
2. redirectUris
3. service account's role and client role.

[clkao]

It seems primehub-secret is not updated if domain is changed (keycloak.url). otherwise the client in keycloak seems to be updated properly.

[popcornylu]

@clkao will fix it in #22