refactor: manage Keycloak setup credentials via Kubernetes Secrets

[sgurunat]

Move the Keycloak realm setup Jobs off inline credential templating and onto standard Kubernetes Secret handling.

Previously the admin user, password and client id were rendered directly into the Job container args, and the resulting OIDC client secret was passed back to Ansible by parsing it out of the Job's stdout. This couples the deployment to log formatting and stores configuration values in places that are awkward to rotate or manage.

Changes:

• Store admin user, password and client id in a Kubernetes Secret (keycloak-admin-credentials-env) and inject them into the Job with envFrom, so the Job spec no longer carries the values. The readiness check reads them from the environment and uses --data-urlencode for correct encoding.
• keycloak-realmcreation.sh now writes the client secret to a Kubernetes Secret (keycloak-client-secret) through the API server using the pod ServiceAccount, instead of emitting it on stdout. Positional arguments are still accepted as a fallback so standalone and documented usage is unchanged.
• Playbooks read the client secret with k8s_info. Retrieval uses failed_when: false to preserve the previous non-fatal behaviour when the secret is unavailable.
• Add a keycloak-realm-setup ServiceAccount with a namespaced Role/RoleBinding scoped to get/create/update/patch on secrets, and set serviceAccountName on both Jobs.
• Mark credential-handling tasks no_log: true to keep values out of Ansible output.

No configuration changes are required: the same inference-config.cfg variables are consumed, and client_secret continues to be passed to the model Helm releases as before.

[AhmedSeemalK]

LGTM this is required change