This changes the Keycloak role to provision the master and an additional user realm. It also creates admin accounts and OAuth clients for the user realm.

Keycloak is now bootstrapped on start.
This causes the playbook to start Keycloak with a random initial password for the admin account if it does not detect a `bootstrapped` file.
This admin user is then instantly repalced with a special ansible service account, which is then used for all future provisioning.

After the bootstrap process is done, we delete the bootstrap env file and the container is retemplated as usual.

Also, we now configure the admin users after Keycloak has started:
- Create temporary initial password
- Create new account in master realm
- Store temporary initial password for user in `initial_passwords` directory
- Assign admin role

Note: The `keycloak_user` action does not change users after they have been created, so its safe to execute even when users set their new passwords.

Further, we now also enable brute force protection on the master realm and create a normal realm along with the configured OAuth OpenID-Connect clients.

We do not offer options for all config options for now and only limit ourselves to the necessary and common ones.
We can easily add more variables later on.
Additionally, we also support creating client roles, which can be useful e.g. for tools like Grafana.

At the moment, we only support creating a single custom realm.

Migration hints:

This role expects you to own a master realm and another user realm.
When migrating existing installations, we recommend the following steps.

- `touch bootstrapped` in the keycloak directory
- Create a service account for ansible and configure the new provision client secret variable. (Look at the bootstrap playbook for hints on how to create a service account)
- Configure your user realm in `keycloak_realm`, clients are optional and will not be deleted if none are added

@@ -36,0 +72,4 @@
+  #     name: "My Application"
+  #     public_client: false
+  #     standard_flow_enabled: true
+  #     direct_access_grants_enabled: false

@@ -36,0 +74,4 @@
+  #     standard_flow_enabled: true
+  #     direct_access_grants_enabled: false
+  #     service_accounts_enabled: false
+  #     implicit_flow_enabled: false

@@ -0,0 +58,4 @@
+    - name: Retemplate the container file for bootstrapping
+      ansible.builtin.template:
+        src: keycloak.container.j2
+        dest: "/etc/containers/systemd/keycloak.container"