Enforce oauth2.plugins.exclude live, with domain-level scoping

[Damans227]

Fixes #13859. Fixes #13860.

oauth2.plugins.exclude was only checked once, at Spring bean registration time, by ExtensionRegistry. A config change didn't take effect without a restart. Even a restart didn't reliably help. The exclude value may not be loaded from the DB yet when the registry beans initialize. The registry also has no concept of domain at all.

This replaces that with a live check in OAuth2AuthManagerImpl. It runs on every login/verify attempt instead of once at boot.

• isProviderExcluded(providerName, domainId) checks the global oauth2.plugins.exclude list first. If a domainId is given, it then checks a new domain-scoped override of the same key.
• oauth2.plugins.exclude is now ConfigKey.Scope.Domain (strict scope, no hierarchy walking). It can be set per domain in addition to globally.
• Domain-level exclude is additive only. A domain can exclude further providers on top of the global list. It can never un-exclude something the global list already excludes.
• getUserOAuth2AuthenticationProvider() gained a (providerName, domainId) overload. Both OAuth2UserAuthenticator.authenticate() and OAuth2AuthManagerImpl.verifySecretCodeAndFetchEmail() use it, since those are the two places that resolve a provider for an actual login attempt. The existing single-arg overload still exists. It delegates with domainId = null, global scope only.
• listUserOAuth2AuthenticationProviders() now filters out excluded providers too. listOauthProvider stops reporting an excluded provider as available.

Added test coverage for the union logic, the domain-scoped config key, and both call sites.

[Damans227]

@blueorangutan package

[blueorangutan]

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[codecov]

Codecov Report

❌ Patch coverage is 90.32258% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.65%. Comparing base (1ceb1d0) to head (5b0ceca).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...pache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	89.65%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##              main   #13867       +/-   ##
============================================
+ Coverage     3.41%   19.65%   +16.23%     
- Complexity       0    19801    +19801     
============================================
  Files          487     6368     +5881     
  Lines        41867   574916   +533049     
  Branches      7912    70358    +62446     
============================================
+ Hits          1429   112975   +111546     
- Misses       40238   449676   +409438     
- Partials       200    12265    +12065     

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	20.92% <90.32%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18842

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian Build Failed (tid-16750)