MGDSTRM-10438: allow operator overrides to express listener authentication overrides

[k-wall]

Use case is to allow the tuning of JWKS cert refresh defaults

[k-wall]

@grdryn I took a different approach, please take another look

[k-wall]

I verified the changes end to end and confirm that overridden jwks parameters are appearing in the kafka resource.

oc get kafka -n kafka-cguqa11h2qfcuvj135i0 -o json kwall-penguin| jq '.spec.kafka.listeners[0].authentication'
{
  "accessTokenIsJwt": true,
  "checkAccessTokenType": true,
  "checkIssuer": true,
  "customClaimCheck": "@.rh-org-id == '13639843'|| @.org_id == '13639843'",
  "enableOauthBearer": true,
  "enablePlain": true,
  "fallbackUserNameClaim": "preferred_username",
  "jwksEndpointUri": "https://sso-keycloak.apps.kwall-kafka.nvee.s1.devshift.org/auth/realms/rhoas/protocol/openid-connect/certs",
  "jwksExpirySeconds": 3600,
  "jwksMinRefreshPauseSeconds": 5,
  "jwksRefreshSeconds": 900,
  "tlsTrustedCertificates": [
    {
      "certificate": "keycloak.crt",
      "secretName": "kwall-penguin-sso-cert"
    }
  ],
  "tokenEndpointUri": "https://sso-keycloak.apps.kwall-kafka.nvee.s1.devshift.org/auth/realms/rhoas/protocol/openid-connect/token",
  "type": "oauth",
  "userNameClaim": "clientId",
  "validIssuerUri": "https://sso-keycloak.apps.kwall-kafka.nvee.s1.devshift.org/auth/realms/rhoas"
}

[sonarcloud[bot]]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
1 Code Smell

78.3% Coverage
0.0% Duplication